{"id":"ASB-A-508390497", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-49880", "A-508390497"], "details":"In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["152157930526192536816128854896592118813", "41613029812386409780486726470858370062", "255047040492351171474959648047956413870", "120618831608176963524129507322499430795", "239323682890214605812839920791860537773", "63508091743452867297962153855251936564", "182513641982644911842618346493343550722", "283141489562142883587521961977190670798", "314636659477928114725597794269267462898", "317275237890320327709779896453215065535", "271766284008791160849007988890760000239", "228259714493390032019869720930386221083", "205530279414354508726942952982564313222", "279114995263695159063249461220586944108", "202211479654350378781470717503433303260", "152002589675868104584121476169344682395", "86406249618623962061271767447125711126", "866470406131785392688925713048690960", "82690023572716875996157835564090829317", "67684167402024307573346775535430867162", "65213219031797729827619534616832227722", "76203405964321458413297565535813960487", "97606039263880642799881588789716357758", "146267266102257269357770808434906716355", "180859710997240488392739946553067255335", "8712647110912205825651204845187110755", "126157536433089580938869777278768808817", "37400744586269507507665060537948458306", "203547331500832945056732272393820910981", "178292279392662583976188720783623500800"], "threshold":0.9}, "id":"ASB-A-508390497-28597598", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"238829896495985789989614165120954943846", "length":480}, "id":"ASB-A-508390497-4730bcfc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"function_hash":"328936099919140081861732982492506691034", "length":433}, "id":"ASB-A-508390497-670688a9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_check_sw"}}, {"deprecated":false, "digest":{"line_hashes":["78736959399154066486234987610909216218", "71208027509033197731387020223873420735", "33486568881350148964836785445900787374", "339045180244430350007169829030600411991"], "threshold":0.9}, "id":"ASB-A-508390497-77a52b93", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"}}, {"deprecated":false, "digest":{"function_hash":"59871013428157506864551094048293824739", "length":4738}, "id":"ASB-A-508390497-7ae63c34", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"182881868032438019024232192557046453396", "length":263}, "id":"ASB-A-508390497-9de26fd0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_initialize_data"}}, {"deprecated":false, "digest":{"function_hash":"326366401751346550915570579071458748986", "length":1106}, "id":"ASB-A-508390497-a5920e16", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_cc_info"}}, {"deprecated":false, "digest":{"function_hash":"142659283415739987162837670383468492450", "length":400}, "id":"ASB-A-508390497-ca516439", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_free_rx_buf"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"59871013428157506864551094048293824739", "length":4738}, "id":"ASB-A-508390497-0a1e340b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"326366401751346550915570579071458748986", "length":1106}, "id":"ASB-A-508390497-73176411", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_cc_info"}}, {"deprecated":false, "digest":{"line_hashes":["152157930526192536816128854896592118813", "41613029812386409780486726470858370062", "255047040492351171474959648047956413870", "120618831608176963524129507322499430795", "239323682890214605812839920791860537773", "63508091743452867297962153855251936564", "182513641982644911842618346493343550722", "283141489562142883587521961977190670798", "314636659477928114725597794269267462898", "317275237890320327709779896453215065535", "271766284008791160849007988890760000239", "228259714493390032019869720930386221083", "205530279414354508726942952982564313222", "279114995263695159063249461220586944108", "202211479654350378781470717503433303260", "152002589675868104584121476169344682395", "86406249618623962061271767447125711126", "866470406131785392688925713048690960", "82690023572716875996157835564090829317", "67684167402024307573346775535430867162", "65213219031797729827619534616832227722", "76203405964321458413297565535813960487", "97606039263880642799881588789716357758", "146267266102257269357770808434906716355", "180859710997240488392739946553067255335", "8712647110912205825651204845187110755", "126157536433089580938869777278768808817", "37400744586269507507665060537948458306", "203547331500832945056732272393820910981", "178292279392662583976188720783623500800"], "threshold":0.9}, "id":"ASB-A-508390497-879db3bc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"238829896495985789989614165120954943846", "length":480}, "id":"ASB-A-508390497-95e81dfc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"function_hash":"142659283415739987162837670383468492450", "length":400}, "id":"ASB-A-508390497-9a2f141b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_free_rx_buf"}}, {"deprecated":false, "digest":{"function_hash":"328936099919140081861732982492506691034", "length":433}, "id":"ASB-A-508390497-c8659d81", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_check_sw"}}, {"deprecated":false, "digest":{"line_hashes":["78736959399154066486234987610909216218", "71208027509033197731387020223873420735", "33486568881350148964836785445900787374", "339045180244430350007169829030600411991"], "threshold":0.9}, "id":"ASB-A-508390497-cca8a30c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"}}, {"deprecated":false, "digest":{"function_hash":"182881868032438019024232192557046453396", "length":263}, "id":"ASB-A-508390497-d4cab69e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_initialize_data"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"328936099919140081861732982492506691034", "length":433}, "id":"ASB-A-508390497-1742b7fb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_check_sw"}}, {"deprecated":false, "digest":{"function_hash":"142659283415739987162837670383468492450", "length":400}, "id":"ASB-A-508390497-3e7cd05b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_free_rx_buf"}}, {"deprecated":false, "digest":{"line_hashes":["78736959399154066486234987610909216218", "71208027509033197731387020223873420735", "33486568881350148964836785445900787374", "339045180244430350007169829030600411991"], "threshold":0.9}, "id":"ASB-A-508390497-43dcf3e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"}}, {"deprecated":false, "digest":{"function_hash":"326366401751346550915570579071458748986", "length":1106}, "id":"ASB-A-508390497-5686d63c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_cc_info"}}, {"deprecated":false, "digest":{"line_hashes":["152157930526192536816128854896592118813", "41613029812386409780486726470858370062", "255047040492351171474959648047956413870", "120618831608176963524129507322499430795", "239323682890214605812839920791860537773", "63508091743452867297962153855251936564", "182513641982644911842618346493343550722", "283141489562142883587521961977190670798", "314636659477928114725597794269267462898", "317275237890320327709779896453215065535", "271766284008791160849007988890760000239", "228259714493390032019869720930386221083", "205530279414354508726942952982564313222", "279114995263695159063249461220586944108", "202211479654350378781470717503433303260", "152002589675868104584121476169344682395", "86406249618623962061271767447125711126", "866470406131785392688925713048690960", "82690023572716875996157835564090829317", "67684167402024307573346775535430867162", "65213219031797729827619534616832227722", "76203405964321458413297565535813960487", "97606039263880642799881588789716357758", "146267266102257269357770808434906716355", "180859710997240488392739946553067255335", "8712647110912205825651204845187110755", "126157536433089580938869777278768808817", "37400744586269507507665060537948458306", "203547331500832945056732272393820910981", "178292279392662583976188720783623500800"], "threshold":0.9}, "id":"ASB-A-508390497-c278b99e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"59871013428157506864551094048293824739", "length":4738}, "id":"ASB-A-508390497-dcd842f3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"182881868032438019024232192557046453396", "length":263}, "id":"ASB-A-508390497-dd909649", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_initialize_data"}}, {"deprecated":false, "digest":{"function_hash":"238829896495985789989614165120954943846", "length":480}, "id":"ASB-A-508390497-ff26c9a0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["78736959399154066486234987610909216218", "71208027509033197731387020223873420735", "33486568881350148964836785445900787374", "339045180244430350007169829030600411991"], "threshold":0.9}, "id":"ASB-A-508390497-362da251", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"}}, {"deprecated":false, "digest":{"function_hash":"326366401751346550915570579071458748986", "length":1106}, "id":"ASB-A-508390497-3734c06b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_cc_info"}}, {"deprecated":false, "digest":{"function_hash":"182881868032438019024232192557046453396", "length":263}, "id":"ASB-A-508390497-5700e721", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_initialize_data"}}, {"deprecated":false, "digest":{"function_hash":"328936099919140081861732982492506691034", "length":433}, "id":"ASB-A-508390497-768dbeb2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_check_sw"}}, {"deprecated":false, "digest":{"function_hash":"59871013428157506864551094048293824739", "length":4738}, "id":"ASB-A-508390497-96b0d74f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_handle_file_operations"}}, {"deprecated":false, "digest":{"function_hash":"238829896495985789989614165120954943846", "length":480}, "id":"ASB-A-508390497-b9c7ba63", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_store_rx_buf"}}, {"deprecated":false, "digest":{"line_hashes":["152157930526192536816128854896592118813", "41613029812386409780486726470858370062", "255047040492351171474959648047956413870", "120618831608176963524129507322499430795", "239323682890214605812839920791860537773", "63508091743452867297962153855251936564", "182513641982644911842618346493343550722", "283141489562142883587521961977190670798", "314636659477928114725597794269267462898", "317275237890320327709779896453215065535", "271766284008791160849007988890760000239", "228259714493390032019869720930386221083", "205530279414354508726942952982564313222", "279114995263695159063249461220586944108", "202211479654350378781470717503433303260", "152002589675868104584121476169344682395", "86406249618623962061271767447125711126", "866470406131785392688925713048690960", "82690023572716875996157835564090829317", "67684167402024307573346775535430867162", "65213219031797729827619534616832227722", "76203405964321458413297565535813960487", "97606039263880642799881588789716357758", "146267266102257269357770808434906716355", "180859710997240488392739946553067255335", "8712647110912205825651204845187110755", "126157536433089580938869777278768808817", "37400744586269507507665060537948458306", "203547331500832945056732272393820910981", "178292279392662583976188720783623500800"], "threshold":0.9}, "id":"ASB-A-508390497-e329340a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"142659283415739987162837670383468492450", "length":400}, "id":"ASB-A-508390497-ebbc666b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e", "target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc", "function":"nfa_t4tnfcee_free_rx_buf"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}