CVE-2026-28662

CVE-2026-28662 is a heap buffer overflow causing an out-of-bounds write in p2p_process_prov_disc_bootstrap_req in p2p_pd.c, the code that handles Wi-Fi P2P (Wi-Fi Direct) provisioning discovery bootstrap requests in Android's Wi-Fi stack. It is triggered when a nearby attacker sends a crafted bootstrap request over the air while the device's Wi-Fi is enabled; no user interaction or privileges are required. Successful exploitation yields remote (proximal/adjacent) code execution, meaning anyone within Wi-Fi radio range could run code on the device. Android devices running software prior to the September 2026 Android Security Update are affected. Exploitation is not currently observed: there is no public proof-of-concept, it is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.1%.

What to do: Install the September 2026 Android Security Update (or your device vendor's equivalent build) as soon as it is available and verify the patch level in Settings > About phone. Until patched, consider disabling Wi-Fi Direct/peer-to-peer sharing and Wi-Fi when not needed, since exploitation requires proximity. The patch is part of the September 2026 release that fixes 180 vulnerabilities in total.