{"id":"ASB-A-524820424", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-55277", "A-524820424"], "details":"In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"58348224060187292585181118304767799829", "length":831}, "id":"ASB-A-524820424-26915236", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp", "function":"RoutingManager::checkUiccListenConfigNeeded"}}, {"deprecated":false, "digest":{"line_hashes":["189140065657459750012225455148627765728", "36337222718689286215108669494669910868", "299706125118254246166655915796740778953", "153306459320031275594926476194583677602"], "threshold":0.9}, "id":"ASB-A-524820424-9e6597e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["189140065657459750012225455148627765728", "36337222718689286215108669494669910868", "299706125118254246166655915796740778953", "153306459320031275594926476194583677602"], "threshold":0.9}, "id":"ASB-A-524820424-a6168fa3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"}}, {"deprecated":false, "digest":{"function_hash":"58348224060187292585181118304767799829", "length":831}, "id":"ASB-A-524820424-ce9b5e5f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp", "function":"RoutingManager::checkUiccListenConfigNeeded"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["189140065657459750012225455148627765728", "36337222718689286215108669494669910868", "299706125118254246166655915796740778953", "153306459320031275594926476194583677602"], "threshold":0.9}, "id":"ASB-A-524820424-3ada677b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"}}, {"deprecated":false, "digest":{"function_hash":"58348224060187292585181118304767799829", "length":831}, "id":"ASB-A-524820424-bf868c6c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8", "target":{"file":"NfcNci/nci/jni/RoutingManager.cpp", "function":"RoutingManager::checkUiccListenConfigNeeded"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}