From b357758369270371ae2a89790b609074a0fa2dc7 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Mon, 23 Mar 2026 13:09:37 -1000 Subject: [PATCH] [wifi] Fix use-after-free: read target BSSID before releasing scan results best is a pointer into scan_result_. Move roaming_target_bssid_ assignment before release_scan_results_() to avoid dangling pointer. --- esphome/components/wifi/wifi_component.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/esphome/components/wifi/wifi_component.cpp b/esphome/components/wifi/wifi_component.cpp index 714bf635cae..3448ce156ee 100644 --- a/esphome/components/wifi/wifi_component.cpp +++ b/esphome/components/wifi/wifi_component.cpp @@ -2465,11 +2465,12 @@ void WiFiComponent::process_roaming_scan_() { WiFiAP roam_params = *selected; apply_scan_result_to_params(roam_params, *best); - this->release_scan_results_(); // Mark as roaming attempt - affects retry behavior if connection fails this->roaming_state_ = RoamingState::CONNECTING; - this->roaming_target_bssid_ = best->get_bssid(); + this->roaming_target_bssid_ = best->get_bssid(); // Must read before releasing scan results + + this->release_scan_results_(); // Connect directly - wifi_sta_connect_ handles disconnect internally this->start_connecting(roam_params);