A missing bounds check in the Wi‑Fi 7 Multi‑Link Operation association request processing in hostapd before version 2.12 permits an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi‑Link Element or Per‑STA Profile sub‑element. During processing the link_id field may be interpreted as the value 15, although only link IDs 0‑14 are valid, leading to an out‑of‑bounds write and small memory corruption before the 4‑way handshake, causing the hostapd process to crash and deny service.

The vulnerable component is hostapd from w1.fi. All releases v2.11 and newer development snapshots prior to v2.12 that are compiled with the CONFIG_IEEE80211BE option enabled are affected. The issue applies to any device running hostapd as the access‑point firmware with Multi‑Link Operation support active.

The CVSS score of 6.5 indicates medium severity, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to transmit a malicious Wi‑Fi 7 management frame within the coverage area, without credentials or authentication, to trigger the denial of service. The attack vector is wireless proximity; the impact is localized disruption of all clients serviced by the affected AP. As the flaw is publicly fixed in hostapd 2.12, the primary risk remains only on unpatched systems.