{"id":"ASB-A-511543870","details":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511543870","CVE-2026-58871"],"modified":"2026-11-02T16:56:10.709619455Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false,"digest":{"length":4064,"function_hash":"69537451646574874466354139496475279509"},"id":"ASB-A-511543870-6eeced79","signature_type":"Function"},{"id":"ASB-A-511543870-a5b08615","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["154133551776667016635056924406714310984","220299552162711982186553670909979016304","226643447280043010016779109554673073452","237945745130426166200425852621028166434","93643238932116475079294875079395143602","70966694435237035814367249359902231286","143960209483261425874112610588158081275","338397188818744095756886463915474355494","198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"]}}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0952320b1419da4296bd6435fdbc46e8e88e2a0a"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"wpa_supplicant/aidl/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false,"digest":{"function_hash":"69537451646574874466354139496475279509","length":4064},"id":"ASB-A-511543870-7389dc7e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d"},{"source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"},"deprecated":false,"digest":{"line_hashes":["154133551776667016635056924406714310984","220299552162711982186553670909979016304","226643447280043010016779109554673073452","237945745130426166200425852621028166434","93643238932116475079294875079395143602","70966694435237035814367249359902231286","143960209483261425874112610588158081275","338397188818744095756886463915474355494","198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"],"threshold":0.9},"id":"ASB-A-511543870-b50c55ab","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d494bc9d82a0a733ac0f289c47341a7adadf620d"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"],"threshold":0.9},"id":"ASB-A-511543870-144aca4d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6","target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp"}},{"digest":{"length":4064,"function_hash":"69537451646574874466354139496475279509"},"id":"ASB-A-511543870-af98a5b7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6","target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/ad44e16ceb09dca6452bc4ec96fb4003139bf7e6"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"],"threshold":0.9},"id":"ASB-A-511543870-589788e0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704","target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp"},"deprecated":false},{"id":"ASB-A-511543870-f5ce5390","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704","target":{"file":"wpa_supplicant/aidl/vendor/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false,"digest":{"function_hash":"69537451646574874466354139496475279509","length":4064}}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/7308fb0fc8485169788ceb9035e75ce5481ba704"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false,"digest":{"length":4064,"function_hash":"69537451646574874466354139496475279509"},"id":"ASB-A-511543870-6502562d"},{"id":"ASB-A-511543870-d5cdd74b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"},"deprecated":false,"digest":{"line_hashes":["154133551776667016635056924406714310984","220299552162711982186553670909979016304","226643447280043010016779109554673073452","237945745130426166200425852621028166434","93643238932116475079294875079395143602","70966694435237035814367249359902231286","143960209483261425874112610588158081275","338397188818744095756886463915474355494","198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/03c2cf9d4845b6870238e632b704f0160b129da6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["154133551776667016635056924406714310984","220299552162711982186553670909979016304","226643447280043010016779109554673073452","237945745130426166200425852621028166434","93643238932116475079294875079395143602","70966694435237035814367249359902231286","143960209483261425874112610588158081275","338397188818744095756886463915474355494","198448538130801607478259831142117805773","75217986276871347561408421877663917814","113839474984208069400354312399465145769","248443601370733269258000946941654756859","266358448178854944741883150636233706615","291130880773368472525274928597173380766","280274955224290583222123042353834317710","258340818051071879844749470355050348618","210235919439224065088000514319653488867","206322843219201679200655803121451325820","196827826205208768698468389220198351019"],"threshold":0.9},"id":"ASB-A-511543870-d9dd12fa","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9","target":{"file":"wpa_supplicant/aidl/sta_iface.cpp"}},{"target":{"file":"wpa_supplicant/aidl/sta_iface.cpp","function":"set_type4_frame_classifier"},"deprecated":false,"digest":{"function_hash":"69537451646574874466354139496475279509","length":4064},"id":"ASB-A-511543870-f568cbf4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4d42fe603af356d3d24ca3c5a06220be879e5ce9"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511543870.json"}}],"schema_version":"1.9.2"}