CVE-2026-28662: Remote code execution in Google Android

This vulnerability arises from an out-of-bounds write due to a heap buffer overflow in the p2p_process_prov_disc_bootstrap_req function within the p2p_pd.c component of Google Android. Exploitation can lead to remote code execution by an attacker in proximity, without needing user interaction or elevated privileges. The CVSS v3.1 base score is 8.0, indicating high severity with attack vector as adjacent network, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker within adjacent network range to execute arbitrary code remotely on the affected Android device, potentially compromising confidentiality, integrity, and availability of the system. No user interaction is required, increasing the risk of automated or stealthy attacks. However, there are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided in the available data. Users and administrators should monitor official Google Android security advisories for updates and apply patches promptly once available.