CVE-2026-21094
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.
Risk Assessment
An adjacent attacker can write out-of-bounds memory, potentially causing system crashes or arbitrary code execution.
Recommendation
Apply the SMR Sep-2026 Release 1 patch to fix the vulnerability.
Other vulnerabilities in wpa_supplicant
See all- CVE-2026-78807High
In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.
- CVE-2016-4477High
wpa_supplicant versions 0.4.0 through 2.5 do not reject and characters in passphrase parameters, allowing local users to trigger arbitrary library loading and consequently gain privileges or cause a denial of service (daemon outage) via a crafted SET, SET_CRED, or SET_NETWORK command.
Original NVD description (English source)
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.