{"id":"ASB-A-508389703","details":"In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389703","CVE-2026-28639"],"modified":"2026-10-23T16:03:44.105534497Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9f4efdd67acb88de5f3450a31a85c054156fa4a6"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"],"threshold":0.9},"id":"ASB-A-508389703-2a86de9e","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"16818314322291633275460097298414935547","length":3012},"id":"ASB-A-508389703-b2f25a09","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b129d10e1242590d5d6440273f31c9dbc74cef9b"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127","target":{"file":"src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"length":1502,"function_hash":"79729836797206895689704025013280586248"},"id":"ASB-A-508389703-3d847329"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127","target":{"file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-d7eeead7","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/d0bcd7535019cc60c12dd52d5c33a7289f205127"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"rw_mfc_handle_read_op","file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"316568674960079491700774092437590225035","length":3032},"id":"ASB-A-508389703-615ad84c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-c05dc32c","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/eaa69f6cb80fb3788198387a2345bfdf6961cf4b"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"],"threshold":0.9},"id":"ASB-A-508389703-6228c08f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"},"deprecated":false,"digest":{"function_hash":"16818314322291633275460097298414935547","length":3012},"id":"ASB-A-508389703-d37a675f","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/9afa8e635297a852ee39bd790405bdfef4c37816"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-5a52ea1b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"16818314322291633275460097298414935547","length":3012},"id":"ASB-A-508389703-cdde9819","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef","target":{"file":"libnfc-nci/src/nfc/tags/rw_mfc.cc","function":"rw_mfc_handle_read_op"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/82dd1ae8ef78897bdcb0d9461a49a132e37593ef"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261","target":{"function":"rw_mfc_handle_read_op","file":"src/nfc/tags/rw_mfc.cc"},"deprecated":false,"digest":{"function_hash":"141475372491966701420849365386404463732","length":1536},"id":"ASB-A-508389703-0171a1ca"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70110918374773347930911262741357874023","219359067736481571193907408890658957487","105971907891688931258657976476006671229","70603669222156753987298291599484968309"]},"id":"ASB-A-508389703-a8945549","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261","target":{"file":"src/nfc/tags/rw_mfc.cc"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/83b46a79bf71acf3abb397550c3498fd429f0261"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389703.json"}}],"schema_version":"1.9.0"}