CVE-2026-58374: High severity Hostapd Hostapd vulnerability
In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapdprocessmlassocreq() in src/ap/ieee80211eht.c, the received linkid field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIGIEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hostapdto a version that resolves this vulnerability.Fixed in 2.12 - Compensating control
Apply a network-level mitigation to limit unauthenticated management frame injection from within wireless range (e.g., restrict or segment Wi‑Fi access / isolate SSIDs) until hostapd 2.12 (or the upstream 2026-1 fixes) are deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58374?
The severity of CVE-2026-58374 is medium with a score of 6.5.
How do I fix CVE-2026-58374?
To fix CVE-2026-58374, update to hostapd version 2.12 or later which includes the necessary bounds checks.
What type of attack does CVE-2026-58374 allow?
CVE-2026-58374 allows an unauthenticated attacker within wireless range to exploit a vulnerability in Multi-Link Operation association request processing.
Which versions of hostapd are affected by CVE-2026-58374?
Hostapd versions prior to 2.12 are affected by CVE-2026-58374.
What can an attacker achieve by exploiting CVE-2026-58374?
An attacker can potentially disrupt the Wi-Fi connectivity of devices by sending crafted management frames.