Is CVE-2026-43113 actively exploited?

No active exploitation of CVE-2026-43113 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43113 be exploited remotely?

Partially. CVE-2026-43113 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-43113?

CVE-2026-43113 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-43113

HIGH

CVE-2026-43113

Published: May 6, 2026· Updated: May 8, 2026

8.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.8th

Official Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wl1251: validate packet IDs before indexing tx_frames

wl1251_tx_packet_cb() uses the firmware completion ID directly to index

the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the

completion block, and the callback does not currently verify that it

fits the array before dereferencing it.

Reject completion IDs that fall outside wl->tx_frames[] and keep the

existing NULL check in the same guard. This keeps the fix local to the

trust boundary and avoids touching the rest of the completion flow.

NVD Source

Technical Analysis

CVE-2026-43113 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.