{"id":"ASB-A-495652882","details":"In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-495652882","CVE-2026-28662"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340","target":{"function":"p2p_process_prov_disc_bootstrap_req","file":"src/p2p/p2p_pd.c"},"deprecated":false,"digest":{"function_hash":"204626485748390801538657273454417647548","length":4516},"id":"ASB-A-495652882-48f9840e"},{"digest":{"line_hashes":["329235300157992302450585149736808923972","69590832955794704614152132288535451757","25098407036013714613089605652738761666","220585128298976457405509122453376276502"],"threshold":0.9},"id":"ASB-A-495652882-d95eb265","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/2c8bcabc339fde235d87c59cbce74a23010f8340","target":{"file":"src/p2p/p2p_pd.c"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495652882.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"target":{"file":"src/p2p/p2p_pd.c","function":"p2p_process_prov_disc_bootstrap_req"},"deprecated":false,"digest":{"function_hash":"204626485748390801538657273454417647548","length":4516},"id":"ASB-A-495652882-3df5c198","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/74a0b5c3d95a8cfee76be362a5f5ca6d58d3c2cf"}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/74a0b5c3d95a8cfee76be362a5f5ca6d58d3c2cf"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495652882.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"id":"ASB-A-495652882-a915e470","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5780bb26d93532d90805cb254ec398181e7e5c06","target":{"file":"src/p2p/p2p_pd.c","function":"p2p_process_prov_disc_bootstrap_req"},"deprecated":false,"digest":{"function_hash":"204626485748390801538657273454417647548","length":4516}}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5780bb26d93532d90805cb254ec398181e7e5c06"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495652882.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d","target":{"file":"src/p2p/p2p_pd.c"},"deprecated":false,"digest":{"line_hashes":["329235300157992302450585149736808923972","69590832955794704614152132288535451757","25098407036013714613089605652738761666","220585128298976457405509122453376276502"],"threshold":0.9},"id":"ASB-A-495652882-4e1ddbe8","match_only_versions":["17"]},{"digest":{"length":4516,"function_hash":"204626485748390801538657273454417647548"},"id":"ASB-A-495652882-a1aec906","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/5be91bdded9d82d65c694e88b03e8311ef38c16d","target":{"function":"p2p_process_prov_disc_bootstrap_req","file":"src/p2p/p2p_pd.c"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495652882.json"}}],"schema_version":"1.9.0"}