Executive brief
Android's wireless networking stack contains a flaw in how it validates channel width information from received Wi-Fi management frames. An attacker within Wi-Fi range can craft malicious frames to trigger an out-of-bounds memory read, potentially exposing sensitive information without needing to authenticate or interact with the user.
Technical details
The vulnerability is an out-of-bounds read in the get_eht_operation_channel_width() function within ieee802_11_common.c due to incorrect bounds checking. The flaw is reachable via adjacent network attack vectors (Wi-Fi proximity required). An unauthenticated adjacent attacker can send crafted IEEE 802.11 EHT operation frames to trigger the out-of-bounds read, leading to information disclosure (memory content leak). No user interaction or additional execution privileges are required. Patches are available in AOSP branches 14, 15, 16, 16-qpr2, and 17, with a security patch level of 2026-09-05 or later addressing the issue.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: CVE-2026-49895 published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses the issue