CVE-2026-28617: Android WifiNetworkSuggestionsManager DOS

CVE-2026-28617 Overview

CVE-2026-28617 is a persistent denial-of-service vulnerability in the Android WifiNetworkSuggestionsManager.java component. The flaw resides in the add method and stems from uncontrolled resource consumption [CWE-400]. A local application with low privileges can exhaust system resources by submitting Wi-Fi network suggestions, causing a persistent denial-of-service condition on the affected device.

Exploitation does not require user interaction and does not grant additional execution privileges. The impact is limited to availability, but the DoS condition persists across reboots, which increases the recovery burden for affected users.

Critical Impact
A local, low-privileged application can render Wi-Fi functionality persistently unusable on affected Android devices without any user interaction.

Affected Products

Android platform (Wi-Fi service, WifiNetworkSuggestionsManager component)
Specific affected versions are enumerated in the Android Security Bulletin September 2026

Discovery Timeline

2026-09-08 - CVE-2026-28617 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28617

Vulnerability Analysis

The vulnerability exists in the add method of WifiNetworkSuggestionsManager.java, a system component that manages application-provided Wi-Fi network suggestions. The method fails to enforce adequate bounds on the resources consumed when suggestions are registered.

A local application can invoke the suggestion API repeatedly or with crafted payloads to consume persistent storage or in-memory data structures. Because suggestion state is preserved by the framework, the resulting resource exhaustion survives service restarts and device reboots. This produces a persistent denial-of-service condition that impairs Wi-Fi functionality until the offending state is manually cleared.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] within the Wi-Fi suggestion registration path. The add operation does not sufficiently constrain per-caller resource allocation, allowing a low-privileged application to grow persistent state beyond safe limits.

Attack Vector

The attack requires local access with low privileges and no user interaction. A malicious or compromised application installed on the device invokes the Wi-Fi network suggestion API to trigger the exhaustion condition. Full technical details are available in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-28617

Indicators of Compromise

Persistent failure or degraded behavior of the Android Wi-Fi service that continues across reboots.
Applications repeatedly invoking WifiManager.addNetworkSuggestions() with large or high-volume suggestion payloads.
Unexpected growth in Wi-Fi framework state files or system storage attributable to a single third-party application.

Detection Strategies

Review installed application permissions for CHANGE_WIFI_STATE and audit apps that programmatically add network suggestions at high volume.
Monitor logcat output for anomalous activity from the Wi-Fi subsystem, including repeated suggestion registration events or resource-related warnings.
Use mobile application vetting to identify apps that abuse the network suggestion API prior to deployment on managed devices.

Monitoring Recommendations

Enroll devices in a mobile device management (MDM) platform capable of surfacing Wi-Fi service failures and repeated app crashes.
Track Android Security Bulletin patch levels across the device fleet to confirm remediation status.
Alert on newly installed applications that request Wi-Fi configuration permissions and originate from unverified sources.

How to Mitigate CVE-2026-28617

Immediate Actions Required

Apply the September 2026 Android security patch level or later on all affected devices.
Restrict installation of applications from untrusted sources through MDM policy enforcement.
Audit installed applications that hold Wi-Fi configuration permissions and remove any that are unnecessary or unverified.

Patch Information

Google addressed CVE-2026-28617 in the September 2026 Android Security Bulletin. Device owners should ensure their security patch level is 2026-09-01 or later. OEM patch availability varies by vendor; consult the device manufacturer's advisory for release timing. Reference: Android Security Bulletin September 2026.

Workarounds

Uninstall untrusted third-party applications that request Wi-Fi configuration privileges until the patch is applied.
Perform a factory reset only if persistent Wi-Fi service failure cannot be resolved by uninstalling the responsible application.
Limit application installation to vetted enterprise app stores on managed devices.

bash

# Verify the current Android security patch level on a device
adb shell getprop ro.build.version.security_patch

# Expected output for patched devices:
# 2026-09-01 (or later)