{"id":"CVE-2026-49878","aliases":["A-511544607","ASB-A-511544607","EUVD-2026-92600","GHSA-vhr3-24wx-f8x2","UBUNTU-CVE-2026-49878"],"status":"published","title":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write...","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00288,"percentile":0.21651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":"platform/external/wpa_supplicant_8","fixed_in":["17-next:2026-10-01","15:2026-10-01","16:2026-10-01","16-qpr2:2026-10-01","17:2026-10-01","14:2026-10-01"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"]},{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"]},{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"]},{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"]},{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"]},{"source":"osv","ecosystem":"Android","package":"platform/external/wpa_supplicant_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4","2.1-0ubuntu1.5","2.1-0ubuntu1.6","2.1-0ubuntu1.7","2.1-0ubuntu1.7+esm1","2.1-0ubuntu1.7+esm2","2.1-0ubuntu1.7+esm3","2.1-0ubuntu1.7+esm4","2.1-0ubuntu1.7+esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6","2.4-0ubuntu6.2","2.4-0ubuntu6.3","2.4-0ubuntu6.4","2.4-0ubuntu6.5","2.4-0ubuntu6.6","2.4-0ubuntu6.7","2.4-0ubuntu6.8","2.4-0ubuntu6.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-0ubuntu10","2:2.4-1.1ubuntu1","2:2.6-15ubuntu1","2:2.6-15ubuntu2","2:2.6-15ubuntu2.1","2:2.6-15ubuntu2.2","2:2.6-15ubuntu2.3","2:2.6-15ubuntu2.4","2:2.6-15ubuntu2.5","2:2.6-15ubuntu2.6","2:2.6-15ubuntu2.7","2:2.6-15ubuntu2.8","2:2.6-15ubuntu2.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.9-1ubuntu2","2:2.9-1ubuntu3","2:2.9-1ubuntu4","2:2.9-1ubuntu4.1","2:2.9-1ubuntu4.2","2:2.9-1ubuntu4.3","2:2.9-1ubuntu4.4","2:2.9-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.9.0-21build1","2:2.9.0-23","2:2.10-1","2:2.10-2","2:2.10-6","2:2.10-6ubuntu1","2:2.10-6ubuntu2","2:2.10-6ubuntu2.1","2:2.10-6ubuntu2.2","2:2.10-6ubuntu2.3","2:2.10-6ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.10-15","2:2.10-18","2:2.10-20","2:2.10-21","2:2.10-21build2","2:2.10-21build3","2:2.10-21build4","2:2.10-21ubuntu0.1","2:2.10-21ubuntu0.2","2:2.10-21ubuntu0.3","2:2.10-21ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.11-0ubuntu5","2:2.11-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.11-0ubuntu4","2:2.11-0ubuntu5"]}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49878"},{"url":"https://github.com/advisories/GHSA-vhr3-24wx-f8x2"},{"url":"https://source.android.com/security/bulletin/2026-10-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/wpa_supplicant_8/+/d131540379d631d7dcb09b0169e4462bc65abcca","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2026-49878","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49878","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49878","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-05T18:23:46.958Z","modified":"2026-10-06T03:56:09.436Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-92600","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-05T18:23:46Z","modified":"2026-10-06T03:56:09Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:38.724649Z"}],"ghsa":[{"id":"GHSA-vhr3-24wx-f8x2","title":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write...","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-05T21:31:35Z","modified":"2026-10-05T21:31:39Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:12:48.668129Z"}],"nvd":[{"id":"CVE-2026-49878","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-05T19:17:20.65Z","modified":"2026-10-07T13:04:48.3Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"UBUNTU-CVE-2026-49878","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-05T19:17:00Z","modified":"2026-10-17T12:58:32.730235362Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ASB-A-511544607","description":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-11-09T16:40:10.884737887Z","updated_at":"2026-11-09T17:05:18.698671Z"}]}}