{"id":"ASB-A-503553866","details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503553866","CVE-2026-49882"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503553866-858085f9"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c","target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025},"id":"ASB-A-503553866-8c1c4e3f"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738","target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"140771855070805022637955257069071751877","length":1515},"id":"ASB-A-503553866-0399c0a8","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738","target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503553866-748cf512"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503553866-2855e44b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72"},{"digest":{"length":3045,"function_hash":"164559282213980509558864881922028492306"},"id":"ASB-A-503553866-3ea4b0ad","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"]},"id":"ASB-A-503553866-06b82fdd"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2","target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025},"id":"ASB-A-503553866-ee1f1910","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503553866-1932a88a"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025},"id":"ASB-A-503553866-b3ff427e","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae","target":{"function":"rw_mfc_handle_read_op","file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"length":1549,"function_hash":"95284131742854166556922549794758120622"},"id":"ASB-A-503553866-0ab15cd2","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae","target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","302216940305840752620410839986407042585","111119171691673354834636547081134703908","307859468586770214448927853251946059423","193233323340608752164704765986559187044","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503553866-fef91ab8","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503553866.json"}}],"schema_version":"1.9.0"}