Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
CVE-2025-26423: Android Wi‑Fi module can be forced into permanent crash
CVE-2025-26423 · published 1 year ago
Summary
The Wi‑Fi component in Android can be made to stop working by exploiting a missing check in its code. This lets a local attacker gain higher system rights without any user interaction. Apply the latest Android security updates or patches that fix this issue.
What to do
- Update google platform/packages/modules/wifi to version 15-next:2025-05-01.
- Update google platform/packages/modules/wifi to version 15:2025-05-01.
- Update google platform/packages/modules/wifi to version 13:2025-05-01.
- Update google platform/packages/modules/wifi to version 14:2025-05-01.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | android |
13.0 14.0 15.0 cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* |
|
| Android | platform/packages/modules/wifi |
>= 15-next:0, < 15-next:2025-05-01 >= 15:0, < 15:2025-05-01 >= 13:0, < 13:2025-05-01 >= 14:0, < 14:2025-05-01 Fix: upgrade to 15-next:2025-05-01
|
Original advisory text
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no ...
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published1 May 2025
Updated9 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta