Executive brief
A heap buffer overflow vulnerability exists in Android's Wi-Fi peer-to-peer discovery implementation that can be exploited by adjacent devices without user interaction. An attacker within Wi-Fi range could send a specially crafted Wi-Fi Direct request to trigger the vulnerability and execute arbitrary code on the target device with system privileges.
Technical details
The vulnerability is a heap buffer overflow in the p2p_process_prov_disc_bootstrap_req function within p2p_pd.c, leading to out-of-bounds memory writes. The flaw exists in Android's System component Wi-Fi stack and is triggered when processing provisioning discovery bootstrap requests over the Wi-Fi peer-to-peer interface. Attack vector is adjacent (requires Wi-Fi Direct proximity), requires no user interaction, and can result in remote code execution with no additional privileges needed. The vulnerability affects Android versions 14 through 17; patches were released through AOSP and linked security updates on 2026-09-05 and later patch levels.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue