{"id":"ASB-A-503544522", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-49879", "A-503544522"], "details":"In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-5d115385", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"216556653565837026106072784206893036256", "length":2201}, "id":"ASB-A-503544522-64b890f4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"function_hash":"99904350508985959362138184529612643897", "length":1832}, "id":"ASB-A-503544522-8d53c016", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-19fb6326", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729", "target":{"file":"src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"218701892519819300876583624605778254242", "length":2196}, "id":"ASB-A-503544522-22f3593c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"function_hash":"75691722877044653702814369432102659368", "length":1815}, "id":"ASB-A-503544522-2562a99d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"218701892519819300876583624605778254242", "length":2196}, "id":"ASB-A-503544522-33db01b2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"function_hash":"118518534350673920008214616083200694558", "length":1827}, "id":"ASB-A-503544522-68551ad9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-735ded7b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"218701892519819300876583624605778254242", "length":2196}, "id":"ASB-A-503544522-0be452df", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-b70015cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"118518534350673920008214616083200694558", "length":1827}, "id":"ASB-A-503544522-d78752f1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"99904350508985959362138184529612643897", "length":1832}, "id":"ASB-A-503544522-22ac514c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-8f62aefd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"216556653565837026106072784206893036256", "length":2201}, "id":"ASB-A-503544522-bd8889a0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"211163091138098113796053825009973036484", "length":1832}, "id":"ASB-A-503544522-31086e28", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["189984837621850310110975076864452809522", "275269099640824688943861808898075551164", "273092356505764847811589229707029738664", "59012381441273890035381551749975189539", "249887260241018946617682373070684335526", "73567017774454936399637097714619695095", "240930093917411230762403688944671316267", "225372919876756451930044416900407080054", "5875318803596395521037915168271428169", "294407273910681822995811832916545403849", "307106181037280778747452343436327686927", "31714584449132310925777600591957251043", "268404567238755146179617935783543878489", "100647088357377283931697442166930130805", "109494137046170677588782775351196162230", "18101888481829204235460331680300906270", "55616108076678677775749903227770616582", "137297109742395490921959261364390282151", "125278997207605460688441014896820622010", "12389236688042387261821281729922963100", "308014487992032138473448094037074848919", "296964935151634611401797594768129415236", "319487828726553528062522187987219999549", "13189931611366813464689741840227166482", "207908552790060349622235792224899548340", "110594160942549866687529658870715725260", "286766766468884103814176012513692736471", "236148969285571370065091053091974825472", "296346521507879804972597197408129190699", "139914124754410368207278756292801187179"], "threshold":0.9}, "id":"ASB-A-503544522-571dd7be", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d", "target":{"file":"src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"218701892519819300876583624605778254242", "length":2196}, "id":"ASB-A-503544522-d8fb2780", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}