{"id":"ASB-A-511544607", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-49878", "A-511544607"], "details":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-1c5a0c68", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a", "target":{"file":"wpa_supplicant/robust_av.c"}}, {"deprecated":false, "digest":{"function_hash":"83090997825350420681310442685065341189", "length":2677}, "id":"ASB-A-511544607-b8001e07", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"249514085100634482159435850917943423712", "length":2560}, "id":"ASB-A-511544607-6e18d31b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}, {"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-b05b5a12", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c", "target":{"file":"wpa_supplicant/robust_av.c"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-8345bd92", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4", "target":{"file":"wpa_supplicant/robust_av.c"}}, {"deprecated":false, "digest":{"function_hash":"249514085100634482159435850917943423712", "length":2560}, "id":"ASB-A-511544607-cbc8aa75", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"249514085100634482159435850917943423712", "length":2560}, "id":"ASB-A-511544607-6191e1be", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}, {"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-7e269287", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa", "target":{"file":"wpa_supplicant/robust_av.c"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"83090997825350420681310442685065341189", "length":2677}, "id":"ASB-A-511544607-808befdd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}, {"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-af487d09", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8", "target":{"file":"wpa_supplicant/robust_av.c"}}]}}, {"package":{"name":"platform/external/wpa_supplicant_8", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db"], "severity":"High", "spl":"2026-10-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307687299779718744724231471004323686477", "66346243569687185612506976762303021425", "30466151381088585383605486272318842828", "6607420297330078939182827560909410081", "290844812005007816467524343214159414862", "5584790027185338137449103591756582359", "90456983561854567089756314034065981436", "122154198274337017613069738288556377745", "324057899526311124855969540930184719427"], "threshold":0.9}, "id":"ASB-A-511544607-090aa8f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db", "target":{"file":"wpa_supplicant/robust_av.c"}}, {"deprecated":false, "digest":{"function_hash":"249514085100634482159435850917943423712", "length":2560}, "id":"ASB-A-511544607-b001b5b1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db", "target":{"file":"wpa_supplicant/robust_av.c", "function":"wpas_handle_robust_av_scs_recv_action"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}