CVE-2025-26423: Wifi Module DoS Vulnerability Due to Missing Bounds Check
Summary
CVE-2025-26423: In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. Affects platform/packages/modules/Wifi across 4 version ranges.
>= 13:0, < 13:2025-05-01
>= 14:0, < 14:2025-05-01
>= 15:0, < 15:2025-05-01
>= 15-next:0, < 15-next:2025-05-01
Fixed in 15-next:2025-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Wifi module in Android is responsible for managing wireless network connections, enabling devices to connect to Wi-Fi networks seamlessly. It includes functionalities such as network scanning, connection management, and configuration. This module is crucial for user connectivity and experience, making its security paramount. The identified vulnerability stems from a missing bounds check in the validateIpConfiguration function, which can lead to a denial of service (DoS) condition.
Vulnerability Detail
In the validateIpConfiguration function of WifiConfigurationUtil.java, a missing bounds check allows for a potential denial of service (DoS) attack. This vulnerability can be exploited locally, leading to an escalation of privilege without requiring additional execution privileges. The absence of user interaction for exploitation makes it particularly concerning, as it can be triggered by malicious applications or processes running on the device.
How To Fix
Minimum fixed version
15-next:2025-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2025-26423 vulnerability in the Android Wifi module poses a significant risk due to its potential for local exploitation leading to denial of service. Users are strongly advised to update to the patched versions to ensure their systems remain secure.
See every vulnerability recorded for platform/packages/modules/Wifi →
FAQ
CVE-2025-26423 is a vulnerability in the Android Wifi module that can lead to a denial of service due to a missing bounds check in the validateIpConfiguration function.
The vulnerability can be exploited locally by malicious applications or processes without requiring user interaction, leading to potential escalation of privileges.
The primary consequence is a denial of service (DoS), which can disrupt the normal functioning of the Wifi module and affect user connectivity.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Wifi.
