{"id":"ASB-A-508389525","details":"In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389525","CVE-2026-49885"],"modified":"2026-10-05T16:41:14.034730625Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"},"deprecated":false,"digest":{"line_hashes":["103091566937678522282844264288623708687","191151558181188590818737145567309086363","335436876511915462234360019941570763019","140682489901787050342482012662202944872"],"threshold":0.9},"id":"ASB-A-508389525-62c9aafe","signature_type":"Line","signature_version":"v1"},{"target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_update_file"},"deprecated":false,"digest":{"function_hash":"254424311338487826953687272418942774638","length":1691},"id":"ASB-A-508389525-c9a099b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"51677066153257995893180145516056973907","length":1659},"id":"ASB-A-508389525-0363b8f0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10","target":{"function":"rw_t4t_update_file","file":"src/nfc/tags/rw_t4t.cc"}},{"source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10","target":{"file":"src/nfc/tags/rw_t4t.cc","function":"rw_t4t_set_ber_tlv"},"deprecated":false,"digest":{"length":2784,"function_hash":"44144582395972112694978019736842380219"},"id":"ASB-A-508389525-03e5eb77","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["146075879696261318675728884483768664675","239430720755697664560393316713181674970","86477880180032255508241941027736048432","186567112422195530109700739012903177642","258599218062157932503827019374169621248","324247525830247675773301188317867602971","86477880180032255508241941027736048432","54329666249596431020854685688795608003","189073726553864912313849912779908340528","174492981312846775124732417380400088300","64104638798398007867226593861775759282","240417179533665351729169926213635455406"],"threshold":0.9},"id":"ASB-A-508389525-556b2d07","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10","target":{"file":"src/nfc/tags/rw_t4t.cc"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"},"deprecated":false,"digest":{"line_hashes":["146075879696261318675728884483768664675","239430720755697664560393316713181674970","86477880180032255508241941027736048432","186567112422195530109700739012903177642","258599218062157932503827019374169621248","324247525830247675773301188317867602971","86477880180032255508241941027736048432","54329666249596431020854685688795608003","103091566937678522282844264288623708687","191151558181188590818737145567309086363","335436876511915462234360019941570763019","140682489901787050342482012662202944872"],"threshold":0.9},"id":"ASB-A-508389525-734b0ac2","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_set_ber_tlv"},"deprecated":false,"digest":{"length":2780,"function_hash":"91760922202431221612969729817656673476"},"id":"ASB-A-508389525-b63566f3","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"254424311338487826953687272418942774638","length":1691},"id":"ASB-A-508389525-c1ed7171","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_update_file"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":1691,"function_hash":"254424311338487826953687272418942774638"},"id":"ASB-A-508389525-c53c06a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158","target":{"function":"rw_t4t_update_file","file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_set_ber_tlv"},"deprecated":false,"digest":{"function_hash":"91760922202431221612969729817656673476","length":2780},"id":"ASB-A-508389525-d6b9f94a","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["146075879696261318675728884483768664675","239430720755697664560393316713181674970","86477880180032255508241941027736048432","186567112422195530109700739012903177642","258599218062157932503827019374169621248","324247525830247675773301188317867602971","86477880180032255508241941027736048432","54329666249596431020854685688795608003","103091566937678522282844264288623708687","191151558181188590818737145567309086363","335436876511915462234360019941570763019","140682489901787050342482012662202944872"],"threshold":0.9},"id":"ASB-A-508389525-e454081d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_update_file"},"deprecated":false,"digest":{"length":1691,"function_hash":"254424311338487826953687272418942774638"},"id":"ASB-A-508389525-0f75f9af","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7","target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc","function":"rw_t4t_set_ber_tlv"},"deprecated":false,"digest":{"length":2780,"function_hash":"91760922202431221612969729817656673476"},"id":"ASB-A-508389525-44b745e6","signature_type":"Function"},{"target":{"file":"libnfc-nci/src/nfc/tags/rw_t4t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146075879696261318675728884483768664675","239430720755697664560393316713181674970","86477880180032255508241941027736048432","186567112422195530109700739012903177642","258599218062157932503827019374169621248","324247525830247675773301188317867602971","86477880180032255508241941027736048432","54329666249596431020854685688795608003","103091566937678522282844264288623708687","191151558181188590818737145567309086363","335436876511915462234360019941570763019","140682489901787050342482012662202944872"]},"id":"ASB-A-508389525-6684bb8f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":1710,"function_hash":"168855280160394947439475255203909245399"},"id":"ASB-A-508389525-0ab5f374","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e","target":{"file":"src/nfc/tags/rw_t4t.cc","function":"rw_t4t_update_file"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e","target":{"file":"src/nfc/tags/rw_t4t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146075879696261318675728884483768664675","239430720755697664560393316713181674970","86477880180032255508241941027736048432","186567112422195530109700739012903177642","258599218062157932503827019374169621248","324247525830247675773301188317867602971","86477880180032255508241941027736048432","54329666249596431020854685688795608003","81385781804485318366228471590560471105","335921394151114656905020578621663601379","64104638798398007867226593861775759282","240417179533665351729169926213635455406"]},"id":"ASB-A-508389525-596cb777","signature_type":"Line"},{"id":"ASB-A-508389525-be712eed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e","target":{"function":"rw_t4t_set_ber_tlv","file":"src/nfc/tags/rw_t4t.cc"},"deprecated":false,"digest":{"function_hash":"68571072170501125657667726182242256979","length":2835}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"}}],"schema_version":"1.9.0"}