hostapd fails to process crafted RADIUS packets properly.

published 2025-03-12 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7660

cvss: 3.7; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits: 0; none known

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Patch / fix

distros 3 links 2

suse opensuse azure linux

wpa_supplicant SLE Micro 5.5 2.10-150500.3.6.1
wpa_supplicant Linux Micro 6.1 2.11-slfo.1.1_2.1
wpa_supplicant Linux Micro 6.0 2.10-6.1
wpa_supplicant SLE Micro 5.4, SLE Micro 5.3 2.9-150000.4.42.1
wpa_supplicant SLE Module for Basesystem 15 SP7 2.11-150700.3.3.1
wpa_supplicant SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.10-150600.7.6.1
wpa_supplicant SLES for SAP 15 SP6, SLES 15 SP6-LTSS 2.10-150600.7.11.1
wpa_supplicant SLES LTSS Extended Security 12 SP5 2.9-23.23.1

suse advisories SUSE-SU-2026:4492-1 SUSE-SU-2026:3490-1 SUSE-SU-2026:23072-1 SUSE-SU-2026:23038-1 SUSE-SU-2026:3281-1 SUSE-SU-2026:3159-1

hostapd openSUSE Leap 16.0 2.11-bp160.2.1
wpa_supplicant openSUSE Tumbleweed 2.11-4.1
hostapd openSUSE Tumbleweed 2.11-2.1

opensuse advisories openSUSE-SU-2026:20985-1 openSUSE-SU-2025:14899-1 openSUSE-SU-2025:14890-1

wpa_supplicant CBL-Mariner 2.0, Azure Linux 3.0 2.10-3

azure linux advisories AZL-58604 AZL-58610

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-24912 updated 2026-11-07 cvss 3.7

hostapd: RADIUS Packet Processing Flaw in hostapd

Red Hat Enterprise Linux 8 hostapd Red Hat Enterprise Linux 9 hostapd Red Hat Enterprise Linux 10 hostapd
affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-03-12)

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Jouni Malinen hostapd

Classification

Weakness

CWE-826 Premature Release of Resource During Expected Lifetime

References

w1.fi /cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44
patch
w1.fi /cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109
patch
w1.fi /hostapd/
product
jvn.jp /en/jp/JVN19358384/
third-party-advisory

Sources

CVE List CVE-2025-24912
NVD CVE-2025-24912

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary