{"id":"ASB-A-503557185", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-49884", "A-503557185"], "details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "276605177026192549682155916036735755676", "18813264319421182842429066997647269415", "269812291768778055780385010858457745315", "47612022169556401003954377218902050430", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-858085f9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"197236501930189316576218672212305773135", "length":3025}, "id":"ASB-A-503557185-8c1c4e3f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"140771855070805022637955257069071751877", "length":1515}, "id":"ASB-A-503557185-0399c0a8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738", "target":{"file":"src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}, {"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "276605177026192549682155916036735755676", "18813264319421182842429066997647269415", "269812291768778055780385010858457745315", "47612022169556401003954377218902050430", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-748cf512", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738", "target":{"file":"src/nfc/tags/rw_mfc.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "276605177026192549682155916036735755676", "18813264319421182842429066997647269415", "269812291768778055780385010858457745315", "47612022169556401003954377218902050430", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-2855e44b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"164559282213980509558864881922028492306", "length":3045}, "id":"ASB-A-503557185-3ea4b0ad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "276605177026192549682155916036735755676", "18813264319421182842429066997647269415", "269812291768778055780385010858457745315", "47612022169556401003954377218902050430", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-06b82fdd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"197236501930189316576218672212305773135", "length":3025}, "id":"ASB-A-503557185-ee1f1910", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "276605177026192549682155916036735755676", "18813264319421182842429066997647269415", "269812291768778055780385010858457745315", "47612022169556401003954377218902050430", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-1932a88a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"197236501930189316576218672212305773135", "length":3025}, "id":"ASB-A-503557185-b3ff427e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"95284131742854166556922549794758120622", "length":1549}, "id":"ASB-A-503557185-0ab15cd2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae", "target":{"file":"src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}, {"deprecated":false, "digest":{"line_hashes":["69655206144047763324627390974452071933", "182064786210422084685966623093874170708", "244708649787374183558574779578392251786", "222158656605350524766876329048184061535", "54781843149328907080592043715670447407", "170883185260871902791738363897820123913", "120616904625416001175921474562733008890", "65966796913547699082383393680569635030", "302216940305840752620410839986407042585", "111119171691673354834636547081134703908", "307859468586770214448927853251946059423", "193233323340608752164704765986559187044", "111275732646922159657224336231672813499", "20235284682274191823267581995426420422", "164875801887099318226631497437978374445", "216120922335092149838654609748643070538", "269007645675242652289343423548548410051", "251011635336640036980823830930925547522", "318085585267862951496864666866506085406", "155472057958554937713590160580540954717", "70110918374773347930911262741357874023", "64779778843217230941735465465973207304", "339533047638978539848081104435274426689", "225158239060701749903097012198577329561", "182701919630055983655299266047364710456"], "threshold":0.9}, "id":"ASB-A-503557185-fef91ab8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae", "target":{"file":"src/nfc/tags/rw_mfc.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}