CVE-2016-4477: Google Android

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.

Affected products

• Google Android: version 4.4.4 only; version 5.0.2 only; version 5.1.1 only; version 6.0 only; version 6.0.1 only

Published 2016-05-09. Last modified 2026-06-17.