Incomplete RADIUS Message-Authenticator attribute validation in hostapd

Published: August 17, 2026
Latest version available from: https://w1.fi/security/2026-5/

Vulnerability

hostapd did not check that the RADIUS Message-Authenticator attribute
was long enough to contain the 16 byte HMAC-MD5 output before checking
it. This could result in reading and writing 16 bytes beyond the end of
the message buffer when processing a specifically constructed malformed
message. The written part is a temporary zeroing followed by restoring
the original contents and the main potential impact from this would be
process termination.

This is applicable to all RADIUS messages and both the RADIUS client and
server roles. An attacker would need to be able to send out UDP packets
to hostapd which can have some additional constraints especially for the
client case where a man-in-the-middle position is likely needed.


Vulnerable versions/configurations

All hostapd versions with RADIUS support enabled at runtime
(radius_server_clients, radius_das_client, auth_server_addr,
acct_server_addr set in hostapd.conf).


Acknowledgments

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil
v2. Contributing Researcher: Vivek Parikh.


Possible mitigation steps

- Update to hostapd v2.12.1 or v2.13 or newer once available

- Merge the following commit to an earlier hostapd version and rebuild:

https://git.w1.fi/cgit/hostap/commit/?id=aa02cfa569477f67f3915c8b9a83d1a7ca93693d
RADIUS: Fix Message-Authenticator attribute validation