CVE-2026-49878: Remote Code Execution Vulnerability in wpa_supplicant_8
Summary
CVE-2026-49878: In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. Affects platform/external/wpa_supplicant_8 across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wpa_supplicant_8 is an essential component of the Android ecosystem, providing support for wireless networking protocols. It is responsible for managing Wi-Fi connections and ensuring secure communication over wireless networks. The package is widely used in various Android devices, making its security paramount. The vulnerability in question arises from a logic error in the code, which can lead to severe security implications.
Vulnerability Detail
The vulnerability identified as CVE-2026-49878 is a critical out-of-bounds write issue located in the function wpas_handle_robust_av_scs_recv_action within robust_av.c. This flaw allows attackers to exploit the logic error, potentially leading to remote code execution with system-level privileges. The exploitation does not require user interaction, making it particularly dangerous. If successfully exploited, an attacker could execute arbitrary code on the affected device, compromising its integrity and confidentiality.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the affected functionality in wpa_supplicant_8 until the package is updated. This can be done by modifying the configuration file to prevent the use of robust AV features, although this may limit some wireless functionalities.
Conclusion
The CVE-2026-49878 vulnerability in the wpa_supplicant_8 package poses a significant risk due to its potential for remote code execution. It is crucial for users to update their packages to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for platform/external/wpa_supplicant_8 →
FAQ
CVE-2026-49878 is a remote code execution vulnerability found in the wpa_supplicant_8 package, which can be exploited due to a logic error in the code.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
Not fixing this vulnerability can lead to unauthorized remote code execution, allowing attackers to gain control over the affected devices.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the gradle.lockfile, ensuring your projects remain secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/wpa_supplicant_8.
