{"id":"PUB-A-394278882","details":"There is a OOB write issue in BCM WiFi driver while handling message from firmware. Function wl_notify_scan_status is called when received the event WLC_E_SCAN_COMPLETE from firmware.","aliases":["A-394278882","CVE-2025-36890"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"}],"affected":[{"package":{"name":":unknown:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"severity":"High","spl":"2025-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-394278882.json"}}],"schema_version":"1.9.0"}