{"id":"ASB-A-508389591","details":"In nfc_main_hal_data_cback of nfc_main.cc, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389591","CVE-2026-45513"],"modified":"2026-10-05T16:41:14.911472120Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f58169d22b82357e23cf61d71a578dbb9d99d2ad"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f58169d22b82357e23cf61d71a578dbb9d99d2ad","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc","function":"nfc_main_hal_data_cback"},"deprecated":false,"digest":{"function_hash":"334336578140079665094502607721105575849","length":673},"id":"ASB-A-508389591-387d1237","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["170754138783210127680157545724428070219","44788460179415671622858807556549690751","310805399660305653076231040116728685917","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"],"threshold":0.9},"id":"ASB-A-508389591-91ed6e09","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f58169d22b82357e23cf61d71a578dbb9d99d2ad","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["170754138783210127680157545724428070219","44788460179415671622858807556549690751","310805399660305653076231040116728685917","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"],"threshold":0.9},"id":"ASB-A-508389591-0d1abf3b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/cdcf610905cb7c29a0d4e7b638e1b7e7765f7184","target":{"file":"src/nfc/nfc/nfc_main.cc"}},{"deprecated":false,"digest":{"function_hash":"275861009144483284968298294653966063400","length":658},"id":"ASB-A-508389591-53667040","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/cdcf610905cb7c29a0d4e7b638e1b7e7765f7184","target":{"function":"nfc_main_hal_data_cback","file":"src/nfc/nfc/nfc_main.cc"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/cdcf610905cb7c29a0d4e7b638e1b7e7765f7184"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/90a7b2235d84127168a68e65d98b31e3658b6720","target":{"function":"nfc_main_hal_data_cback","file":"libnfc-nci/src/nfc/nfc/nfc_main.cc"},"deprecated":false,"digest":{"function_hash":"334336578140079665094502607721105575849","length":673},"id":"ASB-A-508389591-b88ef02d","signature_type":"Function"},{"digest":{"line_hashes":["170754138783210127680157545724428070219","44788460179415671622858807556549690751","310805399660305653076231040116728685917","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"],"threshold":0.9},"id":"ASB-A-508389591-d8405b7a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/90a7b2235d84127168a68e65d98b31e3658b6720","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/90a7b2235d84127168a68e65d98b31e3658b6720"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["170754138783210127680157545724428070219","44788460179415671622858807556549690751","310805399660305653076231040116728685917","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"]},"id":"ASB-A-508389591-5d6122e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/562092c3c74f239fc3bed18a9d08ed524cfbb5cd","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/562092c3c74f239fc3bed18a9d08ed524cfbb5cd","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc","function":"nfc_main_hal_data_cback"},"deprecated":false,"digest":{"function_hash":"334336578140079665094502607721105575849","length":673},"id":"ASB-A-508389591-af9acb76"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/562092c3c74f239fc3bed18a9d08ed524cfbb5cd"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/957c620d6df7f57f58687d9251d2cdf58f55e5b1","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc"},"deprecated":false,"digest":{"line_hashes":["170754138783210127680157545724428070219","44788460179415671622858807556549690751","310805399660305653076231040116728685917","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"],"threshold":0.9},"id":"ASB-A-508389591-a752576c"},{"deprecated":false,"digest":{"function_hash":"334336578140079665094502607721105575849","length":673},"id":"ASB-A-508389591-be7f51df","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/957c620d6df7f57f58687d9251d2cdf58f55e5b1","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_main.cc","function":"nfc_main_hal_data_cback"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/957c620d6df7f57f58687d9251d2cdf58f55e5b1"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/ae9215c5ca57a8ec06398d2eb4cb1b612bdc5b32"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/nfc/+/ae9215c5ca57a8ec06398d2eb4cb1b612bdc5b32","target":{"file":"src/nfc/nfc/nfc_main.cc"},"deprecated":false,"digest":{"line_hashes":["25203079861594346139257604309575464795","13688658332924135620595625854475038781","268830187102622671668250535672654371947","6315159150147371774646882160261674985","120254261259676196040900369728320778137","124918455917084326809853185086854992529","292976319413430415944520423771408471935","259355788576539475435772643345278477520"],"threshold":0.9},"id":"ASB-A-508389591-22e35e5e","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":658,"function_hash":"275861009144483284968298294653966063400"},"id":"ASB-A-508389591-e15f62cb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/ae9215c5ca57a8ec06398d2eb4cb1b612bdc5b32","target":{"file":"src/nfc/nfc/nfc_main.cc","function":"nfc_main_hal_data_cback"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389591.json"}}],"schema_version":"1.9.0"}