CVE-2026-28662 Memory corruption in Android

High 8.0 Published 8 Sep 2026 Updated 10 Sep 2026

A heap buffer overflow in Android's Wi-Fi Direct P2P processing allows remote attackers to execute arbitrary code without user interaction or privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-28662?

CVE-2026-28662 is a high-severity memory corruption vulnerability in Google Android, published on 8 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2026-28662?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2026-28662?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-28662 being exploited?

There is no known exploitation of CVE-2026-28662 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as A-495652882, ASB-A-495652882, GHSA-h8r6-j72f-ccjh.