SELECT September builds of Android 17 harbour a critical wide-character parsing flaw in the Bionic C library. The vulnerability affects the wcscspn() and wcspbrk() functions, which prematurely terminate string scans when they encounter non-ASCII characters. The issue was recently confirmed by project maintainers on the Android NDK issue tracker, with researchers noting a production binary regression that did not appear in the public June 2026 AOSP sources.
Reproduction occurred on Google Pixel 7 and Pixel 8a devices running Android 17 build CP3A.260905.009. The defect triggers when a scanned string contains characters at or above code point U+0100, provided the reject set contains at least two distinct characters below U+0100. Under these exact conditions, the parsing logic misclassifies high code points as valid delimiters, causing wide-string processing—such as newlines or wildcard scans—to stall or halt further delimiter processing.
A distinct split exists between public AOSP code and the September device binaries: the public Android 17 source trees published in June 2026 did not exhibit the bug, whereas the updated libc[.]so bundled with the September update did. To identify the regression, engineers reverse‑engineered and disassembled the compiled system binaries, uncovering the divergence between the public release and production builds.
This upstream lag creates friction for third‑party developers attempting to diagnose and remediate the issue. The article notes that the public branch diverges significantly from September device binaries, complicating external diagnostics.