CVE-2026-28662: Wi-Fi P2P Heap Buffer Overflow RCE Vulnerability

CVE-2026-28662 Overview

CVE-2026-28662 is a heap buffer overflow in the p2p_process_prov_disc_bootstrap_req function of p2p_pd.c, a component in the Android Wi-Fi Direct (P2P) provision discovery stack. An adjacent-network attacker can trigger an out-of-bounds write on the heap without user interaction. Successful exploitation permits remote code execution in the context of the vulnerable component with no additional privileges required. The issue is tracked under [CWE-122: Heap-based Buffer Overflow] and disclosed in the Android Security Bulletin September 2026.

Critical Impact
Adjacent attackers within Wi-Fi range can achieve zero-click remote code execution on affected Android devices through malformed P2P provision discovery bootstrap requests.

Affected Products

Android devices implementing the affected p2p_pd.c Wi-Fi Direct provision discovery code
Vendor-specific Android builds referencing the September 2026 Android Security Bulletin
Refer to the Android Security Bulletin September 2026 for the authoritative affected version list

Discovery Timeline

2026-09-08 - CVE-2026-28662 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28662

Vulnerability Analysis

The defect resides in p2p_process_prov_disc_bootstrap_req, the handler that parses Wi-Fi Direct Provision Discovery bootstrap request frames. During parsing, the function writes attacker-controlled data beyond the bounds of a heap-allocated buffer. Because provision discovery frames are processed before any user pairing or authorization, exploitation requires no interaction from the device owner.

The vulnerability sits in the pre-association Wi-Fi Direct code path. An attacker within radio range of a target device with Wi-Fi Direct enabled can transmit crafted management frames that reach the vulnerable parser. Successful memory corruption can be steered toward arbitrary code execution in the process that hosts the P2P stack.

Root Cause

The root cause is missing or incorrect bounds validation on length or offset fields inside the Provision Discovery bootstrap request payload. The parser trusts attacker-supplied size metadata when copying data into a fixed-size heap allocation. This classic [CWE-122] pattern permits adjacent heap metadata and neighboring objects to be overwritten.

Attack Vector

Exploitation requires adjacency to the target over Wi-Fi. The attacker crafts a Wi-Fi Direct Provision Discovery bootstrap request that violates the expected length constraints of one or more parsed fields. When the vulnerable Android device processes the frame, the oversized copy corrupts heap memory. No user prompt, tap, or pairing acceptance is required. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The Android Security Bulletin references the underlying source fix rather than a public proof of concept. See the Android Security Bulletin September 2026 for technical details.

Detection Methods for CVE-2026-28662

Indicators of Compromise

Unexpected crashes or restarts of the Android Wi-Fi or P2P service process, particularly in logs referencing p2p_pd or p2p_process_prov_disc_bootstrap_req
Tombstone or logcat entries showing SIGSEGV or SIGABRT in the Wi-Fi supplicant with heap corruption backtraces
Bursts of unsolicited Wi-Fi Direct Provision Discovery frames observed on nearby channels

Detection Strategies

Deploy wireless intrusion detection sensors that decode 802.11 management frames and flag malformed P2P Public Action frames with anomalous attribute lengths
Correlate mobile device management (MDM) crash telemetry from Android endpoints to identify repeated Wi-Fi stack faults across a fleet
Ingest device tombstones and dropbox reports into a centralized data lake and alert on heap corruption signatures in Wi-Fi processes

Monitoring Recommendations

Monitor the Android security patch level (ro.build.version.security_patch) across managed devices and alert on values earlier than September 2026
Track Wi-Fi Direct usage and disable it via MDM policy on devices that do not require the feature
Baseline normal P2P frame volume in sensitive physical locations and alert on sustained anomalies

How to Mitigate CVE-2026-28662

Immediate Actions Required

Apply the September 2026 Android security patch level or later on all managed devices
Disable Wi-Fi Direct on devices where the feature is not operationally required, using MDM configuration profiles
Prioritize patching for high-risk users and devices operating in untrusted physical environments

Patch Information

Google addressed the issue in the September 2026 Android Security Bulletin. Device manufacturers publish downstream firmware updates that incorporate the AOSP fix. Confirm the security patch level is 2026-09-01 or later after updating, and consult vendor advisories for OEM-specific delivery timelines. Details are available in the Android Security Bulletin September 2026.

Workarounds

Turn off Wi-Fi Direct and Wi-Fi when not in use to reduce the exposure window for adjacent attacks
Restrict device use in high-density untrusted RF environments until patches are deployed
Enforce MDM policies that disable peer-to-peer Wi-Fi features on corporate-managed handsets