CVE-2026-21094

Improper input validation in wpa_supplicant prior to the SMR Sep-2026 Release 1 allows adjacent attackers to exploit this vulnerability to write out-of-bounds memory, potentially leading to arbitrary code execution or system crashes. Organizations using affected versions of wpa_supplicant should prioritize patching to mitigate the risk of exploitation, particularly in environments where adjacent network access is possible.