CVE-2026-49895: Information disclosure in Google Android

The vulnerability CVE-2026-49895 in Google Android is caused by an out-of-bounds read in the get_eht_operation_channel_width function of ieee802_11_common.c. This occurs because of an incorrect bounds check, which can lead to information disclosure. The flaw can be exploited remotely by an attacker in close proximity without needing user interaction or elevated privileges. The issue affects specific Android versions 14, 15, 16, 16-qpr2, and 17. No known exploits are reported in the wild, and no patch information is provided in the available data.

An attacker located near the vulnerable device can remotely trigger an out-of-bounds read, potentially disclosing sensitive information. The vulnerability does not allow privilege escalation, code execution, or denial of service. The impact is limited to confidentiality with no integrity or availability effects. The CVSS score of 3.5 reflects a low severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available information. Until a patch is available, monitoring vendor communications for updates is recommended.