{"id":"ASB-A-503544522","details":"In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503544522","CVE-2026-49879"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"]},"id":"ASB-A-503544522-5d115385"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a","target":{"function":"rw_t3t_send_next_ndef_update_cmd","file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"function_hash":"216556653565837026106072784206893036256","length":2201},"id":"ASB-A-503544522-64b890f4","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"function_hash":"99904350508985959362138184529612643897","length":1832},"id":"ASB-A-503544522-8d53c016","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-503544522-19fb6326","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729","target":{"file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"length":2196,"function_hash":"218701892519819300876583624605778254242"},"id":"ASB-A-503544522-22f3593c"},{"id":"ASB-A-503544522-2562a99d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"function_hash":"75691722877044653702814369432102659368","length":1815}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":2196,"function_hash":"218701892519819300876583624605778254242"},"id":"ASB-A-503544522-33db01b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"length":1827,"function_hash":"118518534350673920008214616083200694558"},"id":"ASB-A-503544522-68551ad9"},{"target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"],"threshold":0.9},"id":"ASB-A-503544522-735ded7b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":2196,"function_hash":"218701892519819300876583624605778254242"},"id":"ASB-A-503544522-0be452df","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e","target":{"function":"rw_t3t_send_next_ndef_update_cmd","file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}},{"deprecated":false,"digest":{"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"],"threshold":0.9},"id":"ASB-A-503544522-b70015cf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"}},{"deprecated":false,"digest":{"function_hash":"118518534350673920008214616083200694558","length":1827},"id":"ASB-A-503544522-d78752f1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"99904350508985959362138184529612643897","length":1832},"id":"ASB-A-503544522-22ac514c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"],"threshold":0.9},"id":"ASB-A-503544522-8f62aefd"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"length":2201,"function_hash":"216556653565837026106072784206893036256"},"id":"ASB-A-503544522-bd8889a0"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"length":1832,"function_hash":"211163091138098113796053825009973036484"},"id":"ASB-A-503544522-31086e28","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d","target":{"file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189984837621850310110975076864452809522","275269099640824688943861808898075551164","273092356505764847811589229707029738664","59012381441273890035381551749975189539","249887260241018946617682373070684335526","73567017774454936399637097714619695095","240930093917411230762403688944671316267","225372919876756451930044416900407080054","5875318803596395521037915168271428169","294407273910681822995811832916545403849","307106181037280778747452343436327686927","31714584449132310925777600591957251043","268404567238755146179617935783543878489","100647088357377283931697442166930130805","109494137046170677588782775351196162230","18101888481829204235460331680300906270","55616108076678677775749903227770616582","137297109742395490921959261364390282151","125278997207605460688441014896820622010","12389236688042387261821281729922963100","308014487992032138473448094037074848919","296964935151634611401797594768129415236","319487828726553528062522187987219999549","13189931611366813464689741840227166482","207908552790060349622235792224899548340","110594160942549866687529658870715725260","286766766468884103814176012513692736471","236148969285571370065091053091974825472","296346521507879804972597197408129190699","139914124754410368207278756292801187179"]},"id":"ASB-A-503544522-571dd7be","signature_type":"Line","signature_version":"v1"},{"digest":{"length":2196,"function_hash":"218701892519819300876583624605778254242"},"id":"ASB-A-503544522-d8fb2780","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d","target":{"function":"rw_t3t_send_next_ndef_update_cmd","file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"}}],"schema_version":"1.9.0"}