{"id":"ASB-A-503545851","details":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503545851","CVE-2026-55261"],"modified":"2026-11-02T16:56:25.723677821Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"line_hashes":["63191397592789039812080927183454678210","227401679283850476089274789614002686054","183253593487986616719784746166198105021","215650173307144901119576521719721467838","28823712557165627363563524783057899273","67684167402024307573346775535430867162","291887736117934319059232137994502442978","160991919170191222784278738526563224259","105118331693720548937117274750040897563","49399150886620645198350490622626044102","295176801620474568155022259595972361699","57089540685188294073150961555657942317","80322347457344623453990531647712737489","140033034442439102585432786852356244599","92425953131558197667340257875499690953"],"threshold":0.9},"id":"ASB-A-503545851-4188724a"},{"digest":{"function_hash":"234867401729365085601419626762111049432","length":4936},"id":"ASB-A-503545851-c805db66","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7","target":{"function":"nfa_t4tnfcee_handle_file_operations","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c51a26973ba862b787b964e0786670507ee3cce7","target":{"function":"nfa_t4tnfcee_store_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"function_hash":"293328105013434728773971556225323590645","length":760},"id":"ASB-A-503545851-cff0eb84","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503545851.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-503545851-a50efeaa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false,"digest":{"function_hash":"234867401729365085601419626762111049432","length":4936}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e","target":{"function":"nfa_t4tnfcee_store_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"function_hash":"293328105013434728773971556225323590645","length":760},"id":"ASB-A-503545851-ae7780d8"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/75533f55267b044e1b12e8e40c08d1b4a3d24b4e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"line_hashes":["63191397592789039812080927183454678210","227401679283850476089274789614002686054","183253593487986616719784746166198105021","215650173307144901119576521719721467838","28823712557165627363563524783057899273","67684167402024307573346775535430867162","291887736117934319059232137994502442978","160991919170191222784278738526563224259","105118331693720548937117274750040897563","49399150886620645198350490622626044102","295176801620474568155022259595972361699","57089540685188294073150961555657942317","80322347457344623453990531647712737489","140033034442439102585432786852356244599","92425953131558197667340257875499690953"],"threshold":0.9},"id":"ASB-A-503545851-f55e1844","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503545851.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d","target":{"function":"nfa_t4tnfcee_store_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"length":760,"function_hash":"293328105013434728773971556225323590645"},"id":"ASB-A-503545851-1651109d"},{"target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["63191397592789039812080927183454678210","227401679283850476089274789614002686054","183253593487986616719784746166198105021","215650173307144901119576521719721467838","28823712557165627363563524783057899273","67684167402024307573346775535430867162","291887736117934319059232137994502442978","160991919170191222784278738526563224259","105118331693720548937117274750040897563","49399150886620645198350490622626044102","295176801620474568155022259595972361699","57089540685188294073150961555657942317","80322347457344623453990531647712737489","140033034442439102585432786852356244599","92425953131558197667340257875499690953"]},"id":"ASB-A-503545851-5196afb7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false,"digest":{"length":4936,"function_hash":"234867401729365085601419626762111049432"},"id":"ASB-A-503545851-718099bc","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/1578e742a98bd7d71a76d9a737cc9d36e8c4705d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503545851.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"293328105013434728773971556225323590645","length":760},"id":"ASB-A-503545851-25adbb88","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492","target":{"function":"nfa_t4tnfcee_store_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["63191397592789039812080927183454678210","227401679283850476089274789614002686054","183253593487986616719784746166198105021","215650173307144901119576521719721467838","28823712557165627363563524783057899273","67684167402024307573346775535430867162","291887736117934319059232137994502442978","160991919170191222784278738526563224259","105118331693720548937117274750040897563","49399150886620645198350490622626044102","295176801620474568155022259595972361699","57089540685188294073150961555657942317","80322347457344623453990531647712737489","140033034442439102585432786852356244599","92425953131558197667340257875499690953"]},"id":"ASB-A-503545851-775260a4","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-503545851-e0a88ef0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false,"digest":{"length":4936,"function_hash":"234867401729365085601419626762111049432"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/25086e4716ab4e3522c8dd0beb8d82cf39274492"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503545851.json"}}],"schema_version":"1.9.2"}