ASB-A-511544607

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-511544607.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-511544607
Aliases
  • A-511544607
  • CVE-2026-49878
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:13Z
Summary
[none]
Details

In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-1c5a0c68",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "83090997825350420681310442685065341189",
                "length":  2677
            },
            "id":  "ASB-A-511544607-b8001e07",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/cf85a899183ff43295acf570570e02e4dde5ee7a",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "249514085100634482159435850917943423712",
                "length":  2560
            },
            "id":  "ASB-A-511544607-6e18d31b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-b05b5a12",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/3bb88db66ab480a4bba31f8dfe09fd67c93f1f6c",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-8345bd92",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "249514085100634482159435850917943423712",
                "length":  2560
            },
            "id":  "ASB-A-511544607-cbc8aa75",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/60bd32c547d0359f29420abe278167d4968d36d4",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "249514085100634482159435850917943423712",
                "length":  2560
            },
            "id":  "ASB-A-511544607-6191e1be",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-7e269287",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/9b8395ca12e825a3aada13d79d755bdbbad380aa",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "83090997825350420681310442685065341189",
                "length":  2677
            },
            "id":  "ASB-A-511544607-808befdd",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-af487d09",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d046f3543dc4365bff8594b9dc1b615efa87aae8",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"
platform/external/wpa_supplicant_8

Package

Name
platform/external/wpa_supplicant_8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "307687299779718744724231471004323686477",
                    "66346243569687185612506976762303021425",
                    "30466151381088585383605486272318842828",
                    "6607420297330078939182827560909410081",
                    "290844812005007816467524343214159414862",
                    "5584790027185338137449103591756582359",
                    "90456983561854567089756314034065981436",
                    "122154198274337017613069738288556377745",
                    "324057899526311124855969540930184719427"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-511544607-090aa8f7",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "249514085100634482159435850917943423712",
                "length":  2560
            },
            "id":  "ASB-A-511544607-b001b5b1",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0272197bfd9f599708ca8c0b0b1210fce764e0db",
            "target":  {
                "file":  "wpa_supplicant/robust_av.c",
                "function":  "wpas_handle_robust_av_scs_recv_action"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-511544607.json"