{"id":"ASB-A-508389908", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-28667", "A-508389908"], "details":"In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"241606101154236611351144547570831723078", "length":2069}, "id":"ASB-A-508389908-2425065e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}, {"deprecated":false, "digest":{"function_hash":"247575275074942422389668042042984432918", "length":5836}, "id":"ASB-A-508389908-5932943b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}, {"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-c3177328", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-1cc43aab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f", "target":{"file":"src/nfc/tags/rw_t5t.cc"}}, {"deprecated":false, "digest":{"function_hash":"148912054026218656259266199220089082747", "length":5839}, "id":"ASB-A-508389908-69c8c25b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f", "target":{"file":"src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}, {"deprecated":false, "digest":{"function_hash":"163020249705269282834834175292665766155", "length":2073}, "id":"ASB-A-508389908-8c8fe849", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f", "target":{"file":"src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-555dd614", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"}}, {"deprecated":false, "digest":{"function_hash":"241606101154236611351144547570831723078", "length":2069}, "id":"ASB-A-508389908-55db527b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}, {"deprecated":false, "digest":{"function_hash":"247575275074942422389668042042984432918", "length":5836}, "id":"ASB-A-508389908-a9db7983", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"247575275074942422389668042042984432918", "length":5836}, "id":"ASB-A-508389908-0b458c3b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}, {"deprecated":false, "digest":{"function_hash":"241606101154236611351144547570831723078", "length":2069}, "id":"ASB-A-508389908-0e78926e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}, {"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-926fdc9d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"247575275074942422389668042042984432918", "length":5836}, "id":"ASB-A-508389908-23387fd7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}, {"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-6db17c74", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"}}, {"deprecated":false, "digest":{"function_hash":"241606101154236611351144547570831723078", "length":2069}, "id":"ASB-A-508389908-f8608147", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d", "target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}]}}, {"package":{"name":"platform/system/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"339441658170093803876067864557097210865", "length":5890}, "id":"ASB-A-508389908-4a0105e3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab", "target":{"file":"src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_update_ndef"}}, {"deprecated":false, "digest":{"line_hashes":["177348562902949138904063912682500931962", "57492838778411510434467684316563420948", "332147715478840539317630616186270389476", "271017236613013489803409497474361393240", "7161245908265945562273808771275592227", "324148222012212297227863312019149157563", "184737047334161826504666475571841208445", "211105018817416339579747681392884674988", "129480160368503821644306826627310384512", "201753248279537466005099585212510108055", "238158208832183012314773904281397288685", "40154651180071720170081376430105523207", "21420892173950433543808113395097473704", "55694857941154281040022956383759407674"], "threshold":0.9}, "id":"ASB-A-508389908-8bd9a2b6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab", "target":{"file":"src/nfc/tags/rw_t5t.cc"}}, {"deprecated":false, "digest":{"function_hash":"157353158569231971931011897701291974097", "length":2124}, "id":"ASB-A-508389908-eeed0ff8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab", "target":{"file":"src/nfc/tags/rw_t5t.cc", "function":"rw_t5t_sm_set_read_only"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}