{"id":"ASB-A-508389055","details":"In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389055","CVE-2026-28653"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"],"threshold":0.9},"id":"ASB-A-508389055-3439a3d8","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4","target":{"function":"rw_t3t_send_next_ndef_check_cmd","file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"length":1658,"function_hash":"191225795765895193381764264358686169756"},"id":"ASB-A-508389055-5013473c","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"function_hash":"118541546654778033272760680839796197195","length":2027},"id":"ASB-A-508389055-b925e665"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-508389055-22a465fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874","target":{"file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"function_hash":"298544333010801987015700944758194455882","length":1641},"id":"ASB-A-508389055-22b5dc5d","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"length":2022,"function_hash":"9146007812321068284982584168091657450"},"id":"ASB-A-508389055-5308b8ae","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"86990937027718195526565406680970965898","length":1653},"id":"ASB-A-508389055-53eaf0ac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"],"threshold":0.9},"id":"ASB-A-508389055-55fb0e5c"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"function_hash":"9146007812321068284982584168091657450","length":2022},"id":"ASB-A-508389055-c32ffb66","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d"],"severity":"Critical","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_check_cmd"},"deprecated":false,"digest":{"function_hash":"86990937027718195526565406680970965898","length":1653},"id":"ASB-A-508389055-1de7bfff","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d","target":{"function":"rw_t3t_send_next_ndef_update_cmd","file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"function_hash":"9146007812321068284982584168091657450","length":2022},"id":"ASB-A-508389055-9c5e16e8","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"],"threshold":0.9},"id":"ASB-A-508389055-e241ca38","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false,"digest":{"function_hash":"118541546654778033272760680839796197195","length":2027},"id":"ASB-A-508389055-03911e70","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53"},{"id":"ASB-A-508389055-2b7f3121","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53","target":{"function":"rw_t3t_send_next_ndef_check_cmd","file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"function_hash":"191225795765895193381764264358686169756","length":1658}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53","target":{"file":"libnfc-nci/src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"],"threshold":0.9},"id":"ASB-A-508389055-52ae4fe9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317"],"severity":"Critical","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"9146007812321068284982584168091657450","length":2022},"id":"ASB-A-508389055-4a779481","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317","target":{"file":"src/nfc/tags/rw_t3t.cc","function":"rw_t3t_send_next_ndef_update_cmd"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317","target":{"function":"rw_t3t_send_next_ndef_check_cmd","file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"function_hash":"161795593754733754778583268307071686127","length":1658},"id":"ASB-A-508389055-9afef553"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317","target":{"file":"src/nfc/tags/rw_t3t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["246090627490318114846672241276697874193","88080322660163282342747813652489436677","69692733816598867409513442215214620512","72574805137619027114153188223265723324","203278942767076670190596356173633270785","152081389016516164934639148043263307894"]},"id":"ASB-A-508389055-aed9ba49","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"}}],"schema_version":"1.9.0"}