{"id":"ASB-A-503545851", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-55261", "A-503545851"], "details":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["63191397592789039812080927183454678210", "227401679283850476089274789614002686054", "183253593487986616719784746166198105021", "215650173307144901119576521719721467838", "28823712557165627363563524783057899273", "67684167402024307573346775535430867162", "291887736117934319059232137994502442978", "160991919170191222784278738526563224259", "105118331693720548937117274750040897563", "49399150886620645198350490622626044102", "295176801620474568155022259595972361699", "57089540685188294073150961555657942317", "80322347457344623453990531647712737489", "140033034442439102585432786852356244599", "92425953131558197667340257875499690953"], "threshold":0.9}, "id":"ASB-A-503545851-4188724a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"234867401729365085601419626762111049432", "length":4936}, "id":"ASB-A-503545851-c805db66", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"293328105013434728773971556225323590645", "length":760}, "id":"ASB-A-503545851-cff0eb84", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"234867401729365085601419626762111049432", "length":4936}, "id":"ASB-A-503545851-a50efeaa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"293328105013434728773971556225323590645", "length":760}, "id":"ASB-A-503545851-ae7780d8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"line_hashes":["63191397592789039812080927183454678210", "227401679283850476089274789614002686054", "183253593487986616719784746166198105021", "215650173307144901119576521719721467838", "28823712557165627363563524783057899273", "67684167402024307573346775535430867162", "291887736117934319059232137994502442978", "160991919170191222784278738526563224259", "105118331693720548937117274750040897563", "49399150886620645198350490622626044102", "295176801620474568155022259595972361699", "57089540685188294073150961555657942317", "80322347457344623453990531647712737489", "140033034442439102585432786852356244599", "92425953131558197667340257875499690953"], "threshold":0.9}, "id":"ASB-A-503545851-f55e1844", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"293328105013434728773971556225323590645", "length":760}, "id":"ASB-A-503545851-1651109d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"line_hashes":["63191397592789039812080927183454678210", "227401679283850476089274789614002686054", "183253593487986616719784746166198105021", "215650173307144901119576521719721467838", "28823712557165627363563524783057899273", "67684167402024307573346775535430867162", "291887736117934319059232137994502442978", "160991919170191222784278738526563224259", "105118331693720548937117274750040897563", "49399150886620645198350490622626044102", "295176801620474568155022259595972361699", "57089540685188294073150961555657942317", "80322347457344623453990531647712737489", "140033034442439102585432786852356244599", "92425953131558197667340257875499690953"], "threshold":0.9}, "id":"ASB-A-503545851-5196afb7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"234867401729365085601419626762111049432", "length":4936}, "id":"ASB-A-503545851-718099bc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"293328105013434728773971556225323590645", "length":760}, "id":"ASB-A-503545851-25adbb88", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"line_hashes":["63191397592789039812080927183454678210", "227401679283850476089274789614002686054", "183253593487986616719784746166198105021", "215650173307144901119576521719721467838", "28823712557165627363563524783057899273", "67684167402024307573346775535430867162", "291887736117934319059232137994502442978", "160991919170191222784278738526563224259", "105118331693720548937117274750040897563", "49399150886620645198350490622626044102", "295176801620474568155022259595972361699", "57089540685188294073150961555657942317", "80322347457344623453990531647712737489", "140033034442439102585432786852356244599", "92425953131558197667340257875499690953"], "threshold":0.9}, "id":"ASB-A-503545851-775260a4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"234867401729365085601419626762111049432", "length":4936}, "id":"ASB-A-503545851-e0a88ef0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}