{"id":"ASB-A-522373576", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-05T16:20:22.411518700Z", "aliases":["CVE-2026-55280", "A-522373576"], "details":"In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"332300021199806898276196870765038763319", "length":2972}, "id":"ASB-A-522373576-4206d6c7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc", "function":"nfa_dm_notify_activation_status"}}, {"deprecated":false, "digest":{"line_hashes":["224483337144346899136422908731896199997", "64214864829456873339004496189990021765", "13163473448524578944396795731108758116", "241491570255537996365097268142210973354"], "threshold":0.9}, "id":"ASB-A-522373576-5b29e7bf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}}, {"deprecated":false, "digest":{"line_hashes":["21168182341866304252807516392202603284", "232049837176814702470155662855112554491", "6084745176542985310750834481754092727", "122479818102312198579909758974427360015", "243410243930635723728979960076061328385", "240405100430186187040148260853526688334", "255739270963456306362760784403792887566", "216399300597495014063020147027187701503", "272113355203347937268749268958447048336", "331253325747776485934187759077618550323"], "threshold":0.9}, "id":"ASB-A-522373576-d5fe73e1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"85417654253623690778142036628305194412", "length":6214}, "id":"ASB-A-522373576-f0ab0b6f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc", "function":"nfc_ncif_proc_activate"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"332300021199806898276196870765038763319", "length":2972}, "id":"ASB-A-522373576-668bb704", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc", "function":"nfa_dm_notify_activation_status"}}, {"deprecated":false, "digest":{"function_hash":"85417654253623690778142036628305194412", "length":6214}, "id":"ASB-A-522373576-8538f4f5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc", "function":"nfc_ncif_proc_activate"}}, {"deprecated":false, "digest":{"line_hashes":["21168182341866304252807516392202603284", "232049837176814702470155662855112554491", "6084745176542985310750834481754092727", "122479818102312198579909758974427360015", "243410243930635723728979960076061328385", "240405100430186187040148260853526688334", "255739270963456306362760784403792887566", "216399300597495014063020147027187701503", "272113355203347937268749268958447048336", "331253325747776485934187759077618550323"], "threshold":0.9}, "id":"ASB-A-522373576-f0044a6e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"}}, {"deprecated":false, "digest":{"line_hashes":["224483337144346899136422908731896199997", "64214864829456873339004496189990021765", "13163473448524578944396795731108758116", "241491570255537996365097268142210973354"], "threshold":0.9}, "id":"ASB-A-522373576-f6d1d7bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"85417654253623690778142036628305194412", "length":6214}, "id":"ASB-A-522373576-2a4df616", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc", "function":"nfc_ncif_proc_activate"}}, {"deprecated":false, "digest":{"line_hashes":["21168182341866304252807516392202603284", "232049837176814702470155662855112554491", "6084745176542985310750834481754092727", "122479818102312198579909758974427360015", "243410243930635723728979960076061328385", "240405100430186187040148260853526688334", "255739270963456306362760784403792887566", "216399300597495014063020147027187701503", "272113355203347937268749268958447048336", "331253325747776485934187759077618550323"], "threshold":0.9}, "id":"ASB-A-522373576-34429e72", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"}}, {"deprecated":false, "digest":{"line_hashes":["224483337144346899136422908731896199997", "64214864829456873339004496189990021765", "13163473448524578944396795731108758116", "241491570255537996365097268142210973354"], "threshold":0.9}, "id":"ASB-A-522373576-580c9fca", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}}, {"deprecated":false, "digest":{"function_hash":"332300021199806898276196870765038763319", "length":2972}, "id":"ASB-A-522373576-f2faba17", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc", "function":"nfa_dm_notify_activation_status"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"85417654253623690778142036628305194412", "length":6214}, "id":"ASB-A-522373576-4750cba3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc", "function":"nfc_ncif_proc_activate"}}, {"deprecated":false, "digest":{"function_hash":"332300021199806898276196870765038763319", "length":2972}, "id":"ASB-A-522373576-9adf03ce", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc", "function":"nfa_dm_notify_activation_status"}}, {"deprecated":false, "digest":{"line_hashes":["224483337144346899136422908731896199997", "64214864829456873339004496189990021765", "13163473448524578944396795731108758116", "241491570255537996365097268142210973354"], "threshold":0.9}, "id":"ASB-A-522373576-d08ebc07", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56", "target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}}, {"deprecated":false, "digest":{"line_hashes":["21168182341866304252807516392202603284", "232049837176814702470155662855112554491", "6084745176542985310750834481754092727", "122479818102312198579909758974427360015", "243410243930635723728979960076061328385", "240405100430186187040148260853526688334", "255739270963456306362760784403792887566", "216399300597495014063020147027187701503", "272113355203347937268749268958447048336", "331253325747776485934187759077618550323"], "threshold":0.9}, "id":"ASB-A-522373576-d3a27f04", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56", "target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}