{"id":"ASB-A-508389525", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-49885", "A-508389525"], "details":"In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["103091566937678522282844264288623708687", "191151558181188590818737145567309086363", "335436876511915462234360019941570763019", "140682489901787050342482012662202944872"], "threshold":0.9}, "id":"ASB-A-508389525-62c9aafe", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"}}, {"deprecated":false, "digest":{"function_hash":"254424311338487826953687272418942774638", "length":1691}, "id":"ASB-A-508389525-c9a099b2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"51677066153257995893180145516056973907", "length":1659}, "id":"ASB-A-508389525-0363b8f0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10", "target":{"file":"src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}, {"deprecated":false, "digest":{"function_hash":"44144582395972112694978019736842380219", "length":2784}, "id":"ASB-A-508389525-03e5eb77", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10", "target":{"file":"src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_set_ber_tlv"}}, {"deprecated":false, "digest":{"line_hashes":["146075879696261318675728884483768664675", "239430720755697664560393316713181674970", "86477880180032255508241941027736048432", "186567112422195530109700739012903177642", "258599218062157932503827019374169621248", "324247525830247675773301188317867602971", "86477880180032255508241941027736048432", "54329666249596431020854685688795608003", "189073726553864912313849912779908340528", "174492981312846775124732417380400088300", "64104638798398007867226593861775759282", "240417179533665351729169926213635455406"], "threshold":0.9}, "id":"ASB-A-508389525-556b2d07", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10", "target":{"file":"src/nfc/tags/rw_t4t.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["146075879696261318675728884483768664675", "239430720755697664560393316713181674970", "86477880180032255508241941027736048432", "186567112422195530109700739012903177642", "258599218062157932503827019374169621248", "324247525830247675773301188317867602971", "86477880180032255508241941027736048432", "54329666249596431020854685688795608003", "103091566937678522282844264288623708687", "191151558181188590818737145567309086363", "335436876511915462234360019941570763019", "140682489901787050342482012662202944872"], "threshold":0.9}, "id":"ASB-A-508389525-734b0ac2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"}}, {"deprecated":false, "digest":{"function_hash":"91760922202431221612969729817656673476", "length":2780}, "id":"ASB-A-508389525-b63566f3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_set_ber_tlv"}}, {"deprecated":false, "digest":{"function_hash":"254424311338487826953687272418942774638", "length":1691}, "id":"ASB-A-508389525-c1ed7171", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"254424311338487826953687272418942774638", "length":1691}, "id":"ASB-A-508389525-c53c06a5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}, {"deprecated":false, "digest":{"function_hash":"91760922202431221612969729817656673476", "length":2780}, "id":"ASB-A-508389525-d6b9f94a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_set_ber_tlv"}}, {"deprecated":false, "digest":{"line_hashes":["146075879696261318675728884483768664675", "239430720755697664560393316713181674970", "86477880180032255508241941027736048432", "186567112422195530109700739012903177642", "258599218062157932503827019374169621248", "324247525830247675773301188317867602971", "86477880180032255508241941027736048432", "54329666249596431020854685688795608003", "103091566937678522282844264288623708687", "191151558181188590818737145567309086363", "335436876511915462234360019941570763019", "140682489901787050342482012662202944872"], "threshold":0.9}, "id":"ASB-A-508389525-e454081d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"254424311338487826953687272418942774638", "length":1691}, "id":"ASB-A-508389525-0f75f9af", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}, {"deprecated":false, "digest":{"function_hash":"91760922202431221612969729817656673476", "length":2780}, "id":"ASB-A-508389525-44b745e6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_set_ber_tlv"}}, {"deprecated":false, "digest":{"line_hashes":["146075879696261318675728884483768664675", "239430720755697664560393316713181674970", "86477880180032255508241941027736048432", "186567112422195530109700739012903177642", "258599218062157932503827019374169621248", "324247525830247675773301188317867602971", "86477880180032255508241941027736048432", "54329666249596431020854685688795608003", "103091566937678522282844264288623708687", "191151558181188590818737145567309086363", "335436876511915462234360019941570763019", "140682489901787050342482012662202944872"], "threshold":0.9}, "id":"ASB-A-508389525-6684bb8f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"168855280160394947439475255203909245399", "length":1710}, "id":"ASB-A-508389525-0ab5f374", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e", "target":{"file":"src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_update_file"}}, {"deprecated":false, "digest":{"line_hashes":["146075879696261318675728884483768664675", "239430720755697664560393316713181674970", "86477880180032255508241941027736048432", "186567112422195530109700739012903177642", "258599218062157932503827019374169621248", "324247525830247675773301188317867602971", "86477880180032255508241941027736048432", "54329666249596431020854685688795608003", "81385781804485318366228471590560471105", "335921394151114656905020578621663601379", "64104638798398007867226593861775759282", "240417179533665351729169926213635455406"], "threshold":0.9}, "id":"ASB-A-508389525-596cb777", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e", "target":{"file":"src/nfc/tags/rw_t4t.cc"}}, {"deprecated":false, "digest":{"function_hash":"68571072170501125657667726182242256979", "length":2835}, "id":"ASB-A-508389525-be712eed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e", "target":{"file":"src/nfc/tags/rw_t4t.cc", "function":"rw_t4t_set_ber_tlv"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}