{"id":"ASB-A-508389908","details":"In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508389908","CVE-2026-28667"],"modified":"2026-10-05T16:41:14.511171135Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61","target":{"function":"rw_t5t_sm_set_read_only","file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"function_hash":"241606101154236611351144547570831723078","length":2069},"id":"ASB-A-508389908-2425065e"},{"deprecated":false,"digest":{"function_hash":"247575275074942422389668042042984432918","length":5836},"id":"ASB-A-508389908-5932943b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_update_ndef"}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"],"threshold":0.9},"id":"ASB-A-508389908-c3177328","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"],"threshold":0.9},"id":"ASB-A-508389908-1cc43aab","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f"},{"deprecated":false,"digest":{"function_hash":"148912054026218656259266199220089082747","length":5839},"id":"ASB-A-508389908-69c8c25b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f","target":{"file":"src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_update_ndef"}},{"deprecated":false,"digest":{"function_hash":"163020249705269282834834175292665766155","length":2073},"id":"ASB-A-508389908-8c8fe849","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f","target":{"file":"src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_set_read_only"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c"],"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-508389908-555dd614","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"],"threshold":0.9}},{"target":{"function":"rw_t5t_sm_set_read_only","file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"length":2069,"function_hash":"241606101154236611351144547570831723078"},"id":"ASB-A-508389908-55db527b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c","target":{"function":"rw_t5t_sm_update_ndef","file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"length":5836,"function_hash":"247575275074942422389668042042984432918"},"id":"ASB-A-508389908-a9db7983","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0"],"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":5836,"function_hash":"247575275074942422389668042042984432918"},"id":"ASB-A-508389908-0b458c3b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_update_ndef"}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_set_read_only"},"deprecated":false,"digest":{"function_hash":"241606101154236611351144547570831723078","length":2069},"id":"ASB-A-508389908-0e78926e","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"]},"id":"ASB-A-508389908-926fdc9d","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d"],"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"target":{"function":"rw_t5t_sm_update_ndef","file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"function_hash":"247575275074942422389668042042984432918","length":5836},"id":"ASB-A-508389908-23387fd7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"],"threshold":0.9},"id":"ASB-A-508389908-6db17c74"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d","target":{"file":"libnfc-nci/src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_set_read_only"},"deprecated":false,"digest":{"function_hash":"241606101154236611351144547570831723078","length":2069},"id":"ASB-A-508389908-f8608147","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-508389908-4a0105e3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab","target":{"file":"src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_update_ndef"},"deprecated":false,"digest":{"length":5890,"function_hash":"339441658170093803876067864557097210865"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab","target":{"file":"src/nfc/tags/rw_t5t.cc"},"deprecated":false,"digest":{"line_hashes":["177348562902949138904063912682500931962","57492838778411510434467684316563420948","332147715478840539317630616186270389476","271017236613013489803409497474361393240","7161245908265945562273808771275592227","324148222012212297227863312019149157563","184737047334161826504666475571841208445","211105018817416339579747681392884674988","129480160368503821644306826627310384512","201753248279537466005099585212510108055","238158208832183012314773904281397288685","40154651180071720170081376430105523207","21420892173950433543808113395097473704","55694857941154281040022956383759407674"],"threshold":0.9},"id":"ASB-A-508389908-8bd9a2b6"},{"digest":{"length":2124,"function_hash":"157353158569231971931011897701291974097"},"id":"ASB-A-508389908-eeed0ff8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab","target":{"file":"src/nfc/tags/rw_t5t.cc","function":"rw_t5t_sm_set_read_only"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"}}],"schema_version":"1.9.0"}