CVE-2018-14526: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only
• w1.fi Wpa Supplicant: from 2.0, up to and including 2.6

Published 2018-08-08. Last modified 2026-06-17.