Heap Buffer Overflow in Android Wi-Fi Direct (P2P) Provisioning Discovery Enables Nearby RCE
CVE-2026-28662 is a heap buffer overflow causing an out-of-bounds write in p2p_process_prov_disc_bootstrap_req in p2p_pd.c, the code that handles Wi-Fi P2P (Wi-Fi Direct) provisioning discovery bootstrap requests in Android's Wi-Fi stack. It is triggered when a nearby attacker sends a crafted bootstrap request over the air while the device's Wi-Fi is enabled; no user interaction or privileges are required. Successful exploitation yields remote (proximal/adjacent) code execution, meaning anyone within Wi-Fi radio range could run code on the device. Android devices running software prior to the September 2026 Android Security Update are affected. Exploitation is not currently observed: there is no public proof-of-concept, it is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.1%.
· Google / Android (CNA: [email protected]) Android OS Wi-Fi P2P (Wi-Fi Direct) stack, p2p_process_prov_disc_bootstrap_req in p2p_pd.cmass Out-of-bounds write via integer overflow in Android NFC stack enables RCE
CVE-2026-49879 is an integer overflow in Android's NFC reader/writer code (rw_t3t.cc, the component that handles NFC Type 3/FeliCa tags) that results in an out-of-bounds write when the stack processes crafted tag data. An attacker can trigger it by getting the device to process malicious NFC data — most plausibly a nearby malicious NFC tag — with no user interaction and no special privileges required. Successful exploitation yields remote code execution in the context of the NFC service, though no public proof-of-concept or in-the-wild exploitation is currently known. Any Android device with NFC hardware is potentially affected, with the fix delivered through the September 2026 Android Security Update. EPSS currently estimates only a 0.2% probability of exploitation within 30 days and the flaw is not yet in CISA's KEV catalog.
· Google / Android Android OS NFC stack (rw_t3t.cc, Type 3 tag handling)mass
Heap Buffer Overflow in Android NFC MIFARE Classic Reader Enables RCE
CVE-2026-49882 is a heap buffer overflow in rw_mfc_handle_read_op (rw_mfc.cc), part of the Android NFC stack's handling of MIFARE Classic (MFC) tags. An attacker within NFC range can trigger the flaw by presenting a maliciously crafted MIFARE Classic tag to a device whose NFC reader processes it, with no user interaction and no privileges required. Successful exploitation can lead to remote code execution on the affected device. Android devices carrying the vulnerable NFC code are affected; the data does not specify exact version ranges, and the fix ships in the September 2026 Android security update per related reporting. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns it a low 0.2% probability of exploitation in the next 30 days, so no exploitation is known.
· Google (Android) Android NFC stack, MIFARE Classic tag handling (rw_mfc.cc)mass
Remote DoS/RCE in Android image resolver via DNG rendering check bypass
CVE-2026-28666 is a flaw in LocalImageResolver.java in the Android platform's image-handling code, where a DNG (Digital Negative) image rendering check can be bypassed. The Android security team classifies the issue as a remote persistent denial of service, but notes it could also lead to remote escalation of privilege, requiring no additional execution privileges and no user interaction. An attacker could trigger the flaw by getting a crafted DNG image processed by an affected device, degrading the device persistently or, per the bulletin, gaining elevated code execution. The flaw affects the Android platform component (assigned by
[email protected]), so any Android device shipping the vulnerable image-resolution code is potentially exposed, pending OEM patches. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.
· Google / Android (AOSP) Android platform image handling component (LocalImageResolver.java, DNG rendering)mass
Use-after-free local privilege escalation in Android (Linux kernel KVM IOMMU)
CVE-2026-58846 is a use-after-free in the kvm_iommu_map_sg function (iommu.c) of the KVM IOMMU code in the Android Linux kernel, caused by a missing permission check (CWE-269). A local attacker can reach the vulnerable scatter-gather mapping path and trigger the flaw without user interaction and with no additional execution privileges. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Affected parties are users of Android devices running vulnerable kernel builds; Google shipped the fix in the September 2026 Android Security Update. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.
· Google (Android) Android OS (Linux kernel, KVM IOMMU — kvm_iommu_map_sg in iommu.c)mass
Out-of-Bounds Write in Android NFC (MIFARE Classic) Allows Local Privilege Escalation
CVE-2026-28639 is an out-of-bounds write in rw_mfc_handle_read_op (rw_mfc.cc), the handler for MIFARE Classic tag read operations in the Android NFC stack, caused by a logic error in the code. It is triggered when the NFC subsystem processes MIFARE Classic read operations, and exploitation requires no user interaction and no additional execution privileges. A successful exploit corrupts adjacent memory and can lead to local escalation of privilege on the affected device. All Android devices running the vulnerable NFC code are affected; the flaw is addressed in the September 2026 Android Security Update. There is currently no public proof of concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.1%, so no exploitation is known.
· Google / Android (CNA: [email protected]) Android OS — NFC subsystem (rw_mfc.cc, rw_mfc_handle_read_op)mass Android OS Integer Overflow Enables Local Privilege Escalation
CVE-2026-58820 is a memory safety vulnerability in the Android operating system in which integer overflow conditions in multiple code locations corrupt memory, classified as a heap-based buffer overflow (CWE-122). Triggering it requires only low-level local access, as the flaw can be exploited with no additional execution privileges, meaning an app or process already running on the device can potentially abuse it. Successful exploitation results in local escalation of privilege with high impact on confidentiality, integrity, and availability on the device; no remote or unauthenticated attack path is indicated by the CVSS vector. The available data does not specify which Android versions or components are affected, but the flaw was addressed in Google's September 2026 Android Security Update, so any device not yet running that patch level is plausibly exposed. There is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within the next 30 days.
· Google (Android) Android OSmass
Improper Encryption Key Validation Enables Local Privilege Escalation in Android
CVE-2026-28590 is a local privilege escalation flaw in Android caused by a logic error that results in improper validation of encryption keys in multiple places in the code. It is triggered by code already running locally on the device, with no need for special execution privileges and no user interaction, so any app or process with local code execution could potentially exploit it. An attacker who exploits it gains elevated privileges on the affected device, which is most valuable as one link in a chained attack alongside other flaws (the September 2026 Android bulletin also fixed separate remote code execution issues). Affected parties are users of Android devices that have not yet received the September 2026 Android security update; the specific affected version ranges were not detailed in the available data. There is no known public proof of concept, it is not listed in CISA's Known Exploited Vulnerabilities catalog, and its current probability of exploitation within 30 days is estimated at 0.1%.
· Google (Android) Android OS (multiple components; assigned by [email protected])mass Local Privilege Escalation via Heap Overflow in Android fsck
An out-of-bounds read caused by a heap buffer overflow exists in the read_boot_region function of fsck.c on Android. It can be triggered when the system's fsck tool processes a malformed or crafted filesystem boot region, with no user interaction and no additional execution privileges required. A successful exploit could allow a local attacker to escalate privileges on the affected device. All Android devices running security patch levels prior to the September 2026 Android Security Update are potentially affected. There is no public proof of concept, the flaw is not in CISA KEV, and EPSS is low (0.1%), indicating no known exploitation to date.
· Google (Android) Android (fsck component, read_boot_region in fsck.c) Android devices on security patch levels before the September 2026 Android Security Update; fixed in the September 2026 update (specific affected version rangesmass
Remote Persistent Denial-of-Service in Android parsePartHeaders (CVE-2026-55256)
CVE-2026-55256 is an improper input validation flaw in the parsePartHeaders routine of Android, which parses message part headers; malformed content processed by this parser can trigger a persistent denial of service. It can be triggered remotely, with no attacker privileges and no user interaction required, by delivering crafted data to the affected parsing code. An attacker gains a sustained, persistent denial-of-service condition on the affected device or component; no code execution, privilege escalation, or data exposure is described. Any Android build containing the vulnerable parsing code is affected, but the available data does not specify which Android versions or ranges are impacted. There is currently no known exploitation, no public proof of concept, a low predicted exploitation probability (EPSS 0.2%, 5th percentile), and the flaw is not in the CISA KEV catalog.
· Google (Android / AOSP; CNA: [email protected]) Android - message part header parsing (parsePartHeaders, multiple files)mass