All packages
wpa_supplicant vulnerabilities
3 known CVE vulnerabilities in wpa_supplicant, translated and rated.
- CVE-2026-78807High
In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.
- CVE-2016-4477High
wpa_supplicant versions 0.4.0 through 2.5 do not reject and characters in passphrase parameters, allowing local users to trigger arbitrary library loading and consequently gain privileges or cause a denial of service (daemon outage) via a crafted SET, SET_CRED, or SET_NETWORK command.
- CVE-2026-21094High
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.