{"id":"ASB-A-508389703","details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389703","CVE-2026-28639"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-2a86de9e","signature_type":"Line"},{"id":"ASB-A-508389703-b2f25a09","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"length":3012,"function_hash":"16818314322291633275460097298414935547"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"79729836797206895689704025013280586248","length":1502},"id":"ASB-A-508389703-3d847329","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127"},{"target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-d7eeead7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-508389703-615ad84c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"316568674960079491700774092437590225035","length":3032}},{"target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"],"threshold":0.9},"id":"ASB-A-508389703-c05dc32c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"],"threshold":0.9},"id":"ASB-A-508389703-6228c08f"},{"id":"ASB-A-508389703-d37a675f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816","target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"16818314322291633275460097298414935547","length":3012}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-5a52ea1b"},{"id":"ASB-A-508389703-cdde9819","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef","target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"length":3012,"function_hash":"16818314322291633275460097298414935547"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261","target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"141475372491966701420849365386404463732","length":1536},"id":"ASB-A-508389703-0171a1ca","signature_type":"Function"},{"digest":{"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"],"threshold":0.9},"id":"ASB-A-508389703-a8945549","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261","target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}}],"schema_version":"1.9.0"}