EUVD-2026-92600
GHSA-vhr3-24wx-f8x2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHold System privileges / Wi-Fi proximity
-
DeliveryDeliver crafted SCS action frame
-
ExploitTrigger out-of-bounds write in robust_av.c
-
ExecutionCorrupt wpa_supplicant memory
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected device must receive a crafted Robust AV / SCS (Stream Classification Service) action frame processed by wpa_supplicant's wpas_handle_robust_av_scs_recv_action; the logic error there yields an out-of-bounds write. Per the official vector, exploitation requires PR:H - System-level execution privileges must already be held (the Android bulletin's 'System execution privileges needed'), which is the primary limiting factor and sharply narrows the realistic attacker set. No user interaction is required (UI:N). Scope is limited to Android versions 14 through 17 (including 16-qpr2) running the vulnerable wpa_supplicant build; delivery of SCS action frames is an over-the-air/adjacent channel rather than arbitrary internet-routable traffic. |
| Impact | Signals are mixed and point to a moderate, not emergency, priority. The official CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H, base 7.2 High) describes a low-complexity, no-interaction path to full RCE, but critically requires PR:H - i.e. System-level privileges must already be held to exploit. That single metric is what keeps this out of critical territory and reflects the Android bulletin's own phrasing ('System execution privileges needed'). There is a notable internal tension worth verifying with the vendor: the vulnerable code (wpas_handle_robust_av_scs_recv_action in robust_av.c) parses a RECEIVED SCS/Robust-AV Wi-Fi action frame, which is attacker-supplied network data normally reachable without caller privileges - yet the vector asserts both AV:N and PR:H. This suggests either the frame-reception path is only reachable in a System-privileged context on Android, or the vector is conservative; treat AV:N with caution since SCS action frames are an over-the-air/adjacent channel rather than routable network traffic. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation. Net: a genuine memory-corruption RCE primitive, but the PR:H precondition plus absence of any exploitation signal make this a patch-in-normal-cycle item rather than a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker already operating with System-level privileges on, or in radio/AP proximity to, an affected Android device sends or injects a crafted Robust AV SCS action frame. wpa_supplicant's wpas_handle_robust_av_scs_recv_action mishandles the frame due to a logic error, triggering an out-of-bounds write (CWE-787) that corrupts memory and can be shaped into arbitrary code execution. No user interaction is required; no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.
RemediationAI
Patch status: Patch available per vendor advisory - Google's Android Security Bulletin 2026-10-01 (https://source.android.com/docs/security/bulletin/2026/2026-10-01) is the fix reference, and no separate standalone wpa_supplicant release version or upstream commit is identified in the supplied data, so affected fleets should be updated to the October 2026 (2026-10-01) Android security patch level or later for their device model and OEM build. Because the required prerequisite is that the attacker already holds System execution privileges (PR:H) on the target, the highest-value compensating controls are privilege-hardening ones: reduce the number of components that can run with System privileges, audit and restrict sideloaded or privileged apps, and keep the device locked down so the prerequisite cannot be acquired - trade-off is operational effort and potential loss of functionality for privileged enterprise apps. On the network side, the crafted frame is delivered over the air from Wi-Fi/adjacent range (assessed AV:A), so minimizing exposure to untrusted Wi-Fi (disable Wi-Fi when not needed, avoid connecting to open or attacker-controlled access points, prefer cellular for sensitive sessions) reduces attack surface, at the cost of connectivity and data-usage trade-offs. A narrower technical mitigation is to build or configure wpa_supplicant without the Robust AV / SCS (Wi-Fi QoS Management stream classification) feature on managed device images; this removes the vulnerable handler entirely but disables SCS-based stream classification and can degrade latency/QoS behavior for latency-sensitive audio-video applications. Disabling of the SCS feature and network restrictions are stopgaps only - applying the bulletin patch is the primary fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
wpa_supplicant is the Wi-Fi supplicant stack used across Android to handle 802.11 association, authentication, and management/action frames, and the affected code lives in robust_av.c under the Robust AV (audio/video) QoS feature set built on Wi-Fi QoS Management. The vulnerable function processes inbound Stream Classification Service (SCS) action frames, which carry traffic-classification requests used for latency- and QoS-sensitive streams; a logic error in the parsing/handling path produces a write past the bounds of a memory buffer (CWE-787, out-of-bounds write). Root cause is a boundary/logic mistake in the frame-handling routine rather than a missing capability check, so a well-formed but semantically malicious SCS frame reaching the handler can corrupt adjacent memory in the context of wpa_supplicant, giving a memory-corruption primitive with high confidentiality and integrity impact (C:H/I:H, scope unchanged). The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* and the EUVD affected-version list (Android 14, 15, 16, 16-qpr2, 17) indicate the flaw is present in the wpa_supplicant build shipped with those Android releases.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SCS action frames are delivered over Wi-Fi (AV:A, not N); Android requires System privileges to reach the path (PR:H); low complexity and the OOB-write RCE primitive give full C/I/A impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 2
Executive ViewAI
Android 14 through 17 devices-including those running 16-QPR2-carry a memory-corruption flaw in the platform's Wi-Fi supplicant that can be escalated to full remote code execution on any handset that processes a crafted SCS action frame. The practical risk to the general fleet is contained, because the attacker must already hold System-level execution privileges on the target device and must be within Wi-Fi or adjacent-network range, meaning this primarily raises the value of an existing foothold rather than opening a new mass-exploitation path. Leadership should care because the affected population is broad and the flaw is not yet patchable, so exposure must be managed through inventory, privilege discipline, and network-level monitoring until Google ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least-privilege so that System-level execution access is not broadly granted on managed Android devices, since the PR:H vector requires the attacker to already hold that privilege tier; restrict affected devices to trusted Wi-Fi SSIDs and disable auto-connect to open or untrusted access points to reduce adjacent-vector exposure (AV:A); deploy wireless IPS signatures or monitoring for anomalous SCS / Robust AV action frames; enable and monitor mobile threat defense and EDR for privilege-escalation and anomalous process activity; and apply the vendor patch immediately once Google publishes it for Android 14 through 17 (including 16-QPR2).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB