Incomplete bounds checking of mesh AMPE messages in wpa_supplicant

Published: July 29, 2026
Latest version available from: https://w1.fi/security/2026-4/

Vulnerability

Processing of secure mesh (IEEE 802.11s) AMPE messages in wpa_supplicant
uses incomplete bounds checking for the decryption buffer when
processing a message with an unexpected MIC element length. The MIC
element itself is verified to be sufficiently long, but the case of a
longer than that element ends up in reducing the size of the decryption
buffer and the length of that buffer is not checked separately. This can
result in writing up to 239 bytes of attacker controlled data after the
end of an allocated heap buffer. This can trigger process termination
and potentially other unexpected behavior due to memory corruption.

The AMPE exchange is performed after SAE authentication which requires a
potential attacker to be able to complete authentication successfully,
i.e., to know the password used to protect the mesh.


Vulnerable versions/configurations

All wpa_supplicant versions with CONFIG_MESH=y and mesh enabled at
runtime.


Acknowledgments

Thanks to Mingyu Jung for discovering and reporting the issue.


Possible mitigation steps

- Update to wpa_supplicant v2.12 or newer once available

- Merge the following commit to an earlier wpa_supplicant version and rebuild:

https://git.w1.fi/cgit/hostap/commit/?id=0ef47396926cb8ce4827b6a5a593ebfc270b8e06
mesh: Reject AMPE MIC element with length != AES_BLOCK_SIZE