{"id":"ASB-A-495652882", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28662", "A-495652882"], "details":"In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"204626485748390801538657273454417647548", "length":4516}, "id":"ASB-A-495652882-48f9840e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340", "target":{"file":"src/p2p/p2p_pd.c", "function":"p2p_process_prov_disc_bootstrap_req"}}, {"deprecated":false, "digest":{"line_hashes":["329235300157992302450585149736808923972", "69590832955794704614152132288535451757", "25098407036013714613089605652738761666", "220585128298976457405509122453376276502"], "threshold":0.9}, "id":"ASB-A-495652882-d95eb265", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340", "target":{"file":"src/p2p/p2p_pd.c"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/74a0b5c3d95a8cfee76be362a5f5ca6d58d3c2cf"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"204626485748390801538657273454417647548", "length":4516}, "id":"ASB-A-495652882-3df5c198", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/74a0b5c3d95a8cfee76be362a5f5ca6d58d3c2cf", "target":{"file":"src/p2p/p2p_pd.c", "function":"p2p_process_prov_disc_bootstrap_req"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5780bb26d93532d90805cb254ec398181e7e5c06"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"204626485748390801538657273454417647548", "length":4516}, "id":"ASB-A-495652882-a915e470", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5780bb26d93532d90805cb254ec398181e7e5c06", "target":{"file":"src/p2p/p2p_pd.c", "function":"p2p_process_prov_disc_bootstrap_req"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["329235300157992302450585149736808923972", "69590832955794704614152132288535451757", "25098407036013714613089605652738761666", "220585128298976457405509122453376276502"], "threshold":0.9}, "id":"ASB-A-495652882-4e1ddbe8", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d", "target":{"file":"src/p2p/p2p_pd.c"}}, {"deprecated":false, "digest":{"function_hash":"204626485748390801538657273454417647548", "length":4516}, "id":"ASB-A-495652882-a1aec906", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d", "target":{"file":"src/p2p/p2p_pd.c", "function":"p2p_process_prov_disc_bootstrap_req"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}