wpa_supplicant vulnerabilities

wpa_supplicant versions 0.4.0 through 2.5 do not reject and characters in passphrase parameters, allowing local users to trigger arbitrary library loading and consequently gain privileges or cause a denial of service (daemon outage) via a crafted SET, SET_CRED, or SET_NETWORK command.

In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.

Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.