Sebastián Alba Vives

**Name of the Vulnerable Software and Affected Versions** hostapd versions 2.11 through 2.11 **Description** A missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In the function `hostapd process ml assoc req()`, the `link id` field can be parsed as value 15, while the `links[]` storage only contains valid entries for IDs 0 through 14. This results in an out-of-bounds write and small memory corruption during association processing before the 4-way handshake, leading to a denial of service through process termination. The issue specifically affects systems built with `CONFIG IEEE80211BE` enabled. **Recommendations** Update to version 2.12.