{"id":"ASB-A-508389055", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28653", "A-508389055"], "details":"In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-3439a3d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"191225795765895193381764264358686169756", "length":1658}, "id":"ASB-A-508389055-5013473c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"function_hash":"118541546654778033272760680839796197195", "length":2027}, "id":"ASB-A-508389055-b925e665", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-22a465fd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874", "target":{"file":"src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"298544333010801987015700944758194455882", "length":1641}, "id":"ASB-A-508389055-22b5dc5d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"function_hash":"9146007812321068284982584168091657450", "length":2022}, "id":"ASB-A-508389055-5308b8ae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"86990937027718195526565406680970965898", "length":1653}, "id":"ASB-A-508389055-53eaf0ac", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-55fb0e5c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}, {"deprecated":false, "digest":{"function_hash":"9146007812321068284982584168091657450", "length":2022}, "id":"ASB-A-508389055-c32ffb66", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"86990937027718195526565406680970965898", "length":1653}, "id":"ASB-A-508389055-1de7bfff", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"function_hash":"9146007812321068284982584168091657450", "length":2022}, "id":"ASB-A-508389055-9c5e16e8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-e241ca38", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"118541546654778033272760680839796197195", "length":2027}, "id":"ASB-A-508389055-03911e70", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"function_hash":"191225795765895193381764264358686169756", "length":1658}, "id":"ASB-A-508389055-2b7f3121", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-52ae4fe9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317"], "severity":"Critical", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"9146007812321068284982584168091657450", "length":2022}, "id":"ASB-A-508389055-4a779481", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_update_cmd"}}, {"deprecated":false, "digest":{"function_hash":"161795593754733754778583268307071686127", "length":1658}, "id":"ASB-A-508389055-9afef553", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317", "target":{"file":"src/nfc/tags/rw_t3t.cc", "function":"rw_t3t_send_next_ndef_check_cmd"}}, {"deprecated":false, "digest":{"line_hashes":["246090627490318114846672241276697874193", "88080322660163282342747813652489436677", "69692733816598867409513442215214620512", "72574805137619027114153188223265723324", "203278942767076670190596356173633270785", "152081389016516164934639148043263307894"], "threshold":0.9}, "id":"ASB-A-508389055-aed9ba49", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317", "target":{"file":"src/nfc/tags/rw_t3t.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}