{"id":"ASB-A-511544607","details":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511544607","CVE-2026-49878"],"modified":"2026-10-05T16:41:13.823064892Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a","target":{"file":"wpa_supplicant/robust_av.c"},"deprecated":false,"digest":{"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"],"threshold":0.9},"id":"ASB-A-511544607-1c5a0c68","signature_type":"Line"},{"target":{"file":"wpa_supplicant/robust_av.c","function":"wpas_handle_robust_av_scs_recv_action"},"deprecated":false,"digest":{"length":2677,"function_hash":"83090997825350420681310442685065341189"},"id":"ASB-A-511544607-b8001e07","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a"}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c"],"severity":"High","spl":"2026-10-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"249514085100634482159435850917943423712","length":2560},"id":"ASB-A-511544607-6e18d31b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c","target":{"function":"wpas_handle_robust_av_scs_recv_action","file":"wpa_supplicant/robust_av.c"}},{"id":"ASB-A-511544607-b05b5a12","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c","target":{"file":"wpa_supplicant/robust_av.c"},"deprecated":false,"digest":{"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4","target":{"file":"wpa_supplicant/robust_av.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"]},"id":"ASB-A-511544607-8345bd92","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4","target":{"file":"wpa_supplicant/robust_av.c","function":"wpas_handle_robust_av_scs_recv_action"},"deprecated":false,"digest":{"length":2560,"function_hash":"249514085100634482159435850917943423712"},"id":"ASB-A-511544607-cbc8aa75","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa","target":{"file":"wpa_supplicant/robust_av.c","function":"wpas_handle_robust_av_scs_recv_action"},"deprecated":false,"digest":{"length":2560,"function_hash":"249514085100634482159435850917943423712"},"id":"ASB-A-511544607-6191e1be"},{"digest":{"threshold":0.9,"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"]},"id":"ASB-A-511544607-7e269287","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa","target":{"file":"wpa_supplicant/robust_av.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8","target":{"function":"wpas_handle_robust_av_scs_recv_action","file":"wpa_supplicant/robust_av.c"},"deprecated":false,"digest":{"function_hash":"83090997825350420681310442685065341189","length":2677},"id":"ASB-A-511544607-808befdd"},{"deprecated":false,"digest":{"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"],"threshold":0.9},"id":"ASB-A-511544607-af487d09","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8","target":{"file":"wpa_supplicant/robust_av.c"}}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8"],"severity":"High","spl":"2026-10-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}},{"package":{"name":"platform/external/wpa_supplicant_8","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db","target":{"file":"wpa_supplicant/robust_av.c"},"deprecated":false,"digest":{"line_hashes":["307687299779718744724231471004323686477","66346243569687185612506976762303021425","30466151381088585383605486272318842828","6607420297330078939182827560909410081","290844812005007816467524343214159414862","5584790027185338137449103591756582359","90456983561854567089756314034065981436","122154198274337017613069738288556377745","324057899526311124855969540930184719427"],"threshold":0.9},"id":"ASB-A-511544607-090aa8f7","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db","target":{"file":"wpa_supplicant/robust_av.c","function":"wpas_handle_robust_av_scs_recv_action"},"deprecated":false,"digest":{"function_hash":"249514085100634482159435850917943423712","length":2560},"id":"ASB-A-511544607-b001b5b1","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"}}],"schema_version":"1.9.0"}