{"id":"ASB-A-508389703", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28639", "A-508389703"], "details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-2a86de9e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"16818314322291633275460097298414935547", "length":3012}, "id":"ASB-A-508389703-b2f25a09", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"79729836797206895689704025013280586248", "length":1502}, "id":"ASB-A-508389703-3d847329", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127", "target":{"file":"src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}, {"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-d7eeead7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127", "target":{"file":"src/nfc/tags/rw_mfc.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"316568674960079491700774092437590225035", "length":3032}, "id":"ASB-A-508389703-615ad84c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}, {"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-c05dc32c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-6228c08f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"16818314322291633275460097298414935547", "length":3012}, "id":"ASB-A-508389703-d37a675f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-5a52ea1b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"16818314322291633275460097298414935547", "length":3012}, "id":"ASB-A-508389703-cdde9819", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef", "target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"141475372491966701420849365386404463732", "length":1536}, "id":"ASB-A-508389703-0171a1ca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261", "target":{"file":"src/nfc/tags/rw_mfc.cc", "function":"rw_mfc_handle_read_op"}}, {"deprecated":false, "digest":{"line_hashes":["70110918374773347930911262741357874023", "219359067736481571193907408890658957487", "105971907891688931258657976476006671229", "70603669222156753987298291599484968309"], "threshold":0.9}, "id":"ASB-A-508389703-a8945549", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261", "target":{"file":"src/nfc/tags/rw_mfc.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}