{"id":"ASB-A-511543870", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58871", "A-511543870"], "details":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-6eeced79", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp", "function":"set_type4_frame_classifier"}}, {"deprecated":false, "digest":{"line_hashes":["154133551776667016635056924406714310984", "220299552162711982186553670909979016304", "226643447280043010016779109554673073452", "237945745130426166200425852621028166434", "93643238932116475079294875079395143602", "70966694435237035814367249359902231286", "143960209483261425874112610588158081275", "338397188818744095756886463915474355494", "198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-a5b08615", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-7389dc7e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp", "function":"set_type4_frame_classifier"}}, {"deprecated":false, "digest":{"line_hashes":["154133551776667016635056924406714310984", "220299552162711982186553670909979016304", "226643447280043010016779109554673073452", "237945745130426166200425852621028166434", "93643238932116475079294875079395143602", "70966694435237035814367249359902231286", "143960209483261425874112610588158081275", "338397188818744095756886463915474355494", "198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-b50c55ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-144aca4d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6", "target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp"}}, {"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-af98a5b7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6", "target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp", "function":"set_type4_frame_classifier"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-589788e0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704", "target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp"}}, {"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-f5ce5390", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704", "target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp", "function":"set_type4_frame_classifier"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-6502562d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp", "function":"set_type4_frame_classifier"}}, {"deprecated":false, "digest":{"line_hashes":["154133551776667016635056924406714310984", "220299552162711982186553670909979016304", "226643447280043010016779109554673073452", "237945745130426166200425852621028166434", "93643238932116475079294875079395143602", "70966694435237035814367249359902231286", "143960209483261425874112610588158081275", "338397188818744095756886463915474355494", "198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-d5cdd74b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["154133551776667016635056924406714310984", "220299552162711982186553670909979016304", "226643447280043010016779109554673073452", "237945745130426166200425852621028166434", "93643238932116475079294875079395143602", "70966694435237035814367249359902231286", "143960209483261425874112610588158081275", "338397188818744095756886463915474355494", "198448538130801607478259831142117805773", "75217986276871347561408421877663917814", "113839474984208069400354312399465145769", "248443601370733269258000946941654756859", "266358448178854944741883150636233706615", "291130880773368472525274928597173380766", "280274955224290583222123042353834317710", "258340818051071879844749470355050348618", "210235919439224065088000514319653488867", "206322843219201679200655803121451325820", "196827826205208768698468389220198351019"], "threshold":0.9}, "id":"ASB-A-511543870-d9dd12fa", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"}}, {"deprecated":false, "digest":{"function_hash":"69537451646574874466354139496475279509", "length":4064}, "id":"ASB-A-511543870-f568cbf4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9", "target":{"file":"wpa_supplicant/aidl/sta_iface.cpp", "function":"set_type4_frame_classifier"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}