{"id":"ASB-A-503557185","details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503557185","CVE-2026-49884"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-503557185-858085f9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9}},{"id":"ASB-A-503557185-8c1c4e3f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c","target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"length":1515,"function_hash":"140771855070805022637955257069071751877"},"id":"ASB-A-503557185-0399c0a8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738"},{"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503557185-748cf512","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738","target":{"file":"src/nfc/tags/rw_mfc.cc"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503557185-2855e44b","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"length":3045,"function_hash":"164559282213980509558864881922028492306"},"id":"ASB-A-503557185-3ea4b0ad","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-503557185-06b82fdd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025},"id":"ASB-A-503557185-ee1f1910","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","276605177026192549682155916036735755676","18813264319421182842429066997647269415","269812291768778055780385010858457745315","47612022169556401003954377218902050430","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"],"threshold":0.9},"id":"ASB-A-503557185-1932a88a","signature_type":"Line"},{"target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"197236501930189316576218672212305773135","length":3025},"id":"ASB-A-503557185-b3ff427e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae","target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"95284131742854166556922549794758120622","length":1549},"id":"ASB-A-503557185-0ab15cd2","signature_type":"Function"},{"target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69655206144047763324627390974452071933","182064786210422084685966623093874170708","244708649787374183558574779578392251786","222158656605350524766876329048184061535","54781843149328907080592043715670447407","170883185260871902791738363897820123913","120616904625416001175921474562733008890","65966796913547699082383393680569635030","302216940305840752620410839986407042585","111119171691673354834636547081134703908","307859468586770214448927853251946059423","193233323340608752164704765986559187044","111275732646922159657224336231672813499","20235284682274191823267581995426420422","164875801887099318226631497437978374445","216120922335092149838654609748643070538","269007645675242652289343423548548410051","251011635336640036980823830930925547522","318085585267862951496864666866506085406","155472057958554937713590160580540954717","70110918374773347930911262741357874023","64779778843217230941735465465973207304","339533047638978539848081104435274426689","225158239060701749903097012198577329561","182701919630055983655299266047364710456"]},"id":"ASB-A-503557185-fef91ab8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"}}],"schema_version":"1.9.0"}