{"id":"ASB-A-508390497","details":"In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508390497","CVE-2026-49880"],"modified":"2026-10-05T16:41:13.644619954Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"line_hashes":["152157930526192536816128854896592118813","41613029812386409780486726470858370062","255047040492351171474959648047956413870","120618831608176963524129507322499430795","239323682890214605812839920791860537773","63508091743452867297962153855251936564","182513641982644911842618346493343550722","283141489562142883587521961977190670798","314636659477928114725597794269267462898","317275237890320327709779896453215065535","271766284008791160849007988890760000239","228259714493390032019869720930386221083","205530279414354508726942952982564313222","279114995263695159063249461220586944108","202211479654350378781470717503433303260","152002589675868104584121476169344682395","86406249618623962061271767447125711126","866470406131785392688925713048690960","82690023572716875996157835564090829317","67684167402024307573346775535430867162","65213219031797729827619534616832227722","76203405964321458413297565535813960487","97606039263880642799881588789716357758","146267266102257269357770808434906716355","180859710997240488392739946553067255335","8712647110912205825651204845187110755","126157536433089580938869777278768808817","37400744586269507507665060537948458306","203547331500832945056732272393820910981","178292279392662583976188720783623500800"],"threshold":0.9},"id":"ASB-A-508390497-28597598","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f"},{"target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_store_rx_buf"},"deprecated":false,"digest":{"length":480,"function_hash":"238829896495985789989614165120954943846"},"id":"ASB-A-508390497-4730bcfc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f"},{"digest":{"length":433,"function_hash":"328936099919140081861732982492506691034"},"id":"ASB-A-508390497-670688a9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"function":"nfa_t4tnfcee_check_sw","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"},"deprecated":false,"digest":{"line_hashes":["78736959399154066486234987610909216218","71208027509033197731387020223873420735","33486568881350148964836785445900787374","339045180244430350007169829030600411991"],"threshold":0.9},"id":"ASB-A-508390497-77a52b93","signature_type":"Line"},{"digest":{"length":4738,"function_hash":"59871013428157506864551094048293824739"},"id":"ASB-A-508390497-7ae63c34","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false},{"id":"ASB-A-508390497-9de26fd0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_initialize_data"},"deprecated":false,"digest":{"function_hash":"182881868032438019024232192557046453396","length":263}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"function":"nfa_t4tnfcee_store_cc_info","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"length":1106,"function_hash":"326366401751346550915570579071458748986"},"id":"ASB-A-508390497-a5920e16"},{"id":"ASB-A-508390497-ca516439","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_free_rx_buf"},"deprecated":false,"digest":{"length":400,"function_hash":"142659283415739987162837670383468492450"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/dcbd63d5d860243c331b8308f2192bdaefddb65f"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508390497.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"59871013428157506864551094048293824739","length":4738},"id":"ASB-A-508390497-0a1e340b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_store_cc_info"},"deprecated":false,"digest":{"length":1106,"function_hash":"326366401751346550915570579071458748986"},"id":"ASB-A-508390497-73176411","signature_type":"Function"},{"target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["152157930526192536816128854896592118813","41613029812386409780486726470858370062","255047040492351171474959648047956413870","120618831608176963524129507322499430795","239323682890214605812839920791860537773","63508091743452867297962153855251936564","182513641982644911842618346493343550722","283141489562142883587521961977190670798","314636659477928114725597794269267462898","317275237890320327709779896453215065535","271766284008791160849007988890760000239","228259714493390032019869720930386221083","205530279414354508726942952982564313222","279114995263695159063249461220586944108","202211479654350378781470717503433303260","152002589675868104584121476169344682395","86406249618623962061271767447125711126","866470406131785392688925713048690960","82690023572716875996157835564090829317","67684167402024307573346775535430867162","65213219031797729827619534616832227722","76203405964321458413297565535813960487","97606039263880642799881588789716357758","146267266102257269357770808434906716355","180859710997240488392739946553067255335","8712647110912205825651204845187110755","126157536433089580938869777278768808817","37400744586269507507665060537948458306","203547331500832945056732272393820910981","178292279392662583976188720783623500800"]},"id":"ASB-A-508390497-879db3bc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad"},{"digest":{"function_hash":"238829896495985789989614165120954943846","length":480},"id":"ASB-A-508390497-95e81dfc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_store_rx_buf"},"deprecated":false},{"digest":{"function_hash":"142659283415739987162837670383468492450","length":400},"id":"ASB-A-508390497-9a2f141b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"function":"nfa_t4tnfcee_free_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_check_sw"},"deprecated":false,"digest":{"function_hash":"328936099919140081861732982492506691034","length":433},"id":"ASB-A-508390497-c8659d81","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-508390497-cca8a30c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"},"deprecated":false,"digest":{"line_hashes":["78736959399154066486234987610909216218","71208027509033197731387020223873420735","33486568881350148964836785445900787374","339045180244430350007169829030600411991"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/fb42cb3d918c0165d335e6a3c8729dfad0db29ad","target":{"function":"nfa_t4tnfcee_initialize_data","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"function_hash":"182881868032438019024232192557046453396","length":263},"id":"ASB-A-508390497-d4cab69e","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508390497.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_check_sw"},"deprecated":false,"digest":{"function_hash":"328936099919140081861732982492506691034","length":433},"id":"ASB-A-508390497-1742b7fb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"function":"nfa_t4tnfcee_free_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"length":400,"function_hash":"142659283415739987162837670383468492450"},"id":"ASB-A-508390497-3e7cd05b","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["78736959399154066486234987610909216218","71208027509033197731387020223873420735","33486568881350148964836785445900787374","339045180244430350007169829030600411991"]},"id":"ASB-A-508390497-43dcf3e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"},"deprecated":false},{"digest":{"function_hash":"326366401751346550915570579071458748986","length":1106},"id":"ASB-A-508390497-5686d63c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"function":"nfa_t4tnfcee_store_cc_info","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["152157930526192536816128854896592118813","41613029812386409780486726470858370062","255047040492351171474959648047956413870","120618831608176963524129507322499430795","239323682890214605812839920791860537773","63508091743452867297962153855251936564","182513641982644911842618346493343550722","283141489562142883587521961977190670798","314636659477928114725597794269267462898","317275237890320327709779896453215065535","271766284008791160849007988890760000239","228259714493390032019869720930386221083","205530279414354508726942952982564313222","279114995263695159063249461220586944108","202211479654350378781470717503433303260","152002589675868104584121476169344682395","86406249618623962061271767447125711126","866470406131785392688925713048690960","82690023572716875996157835564090829317","67684167402024307573346775535430867162","65213219031797729827619534616832227722","76203405964321458413297565535813960487","97606039263880642799881588789716357758","146267266102257269357770808434906716355","180859710997240488392739946553067255335","8712647110912205825651204845187110755","126157536433089580938869777278768808817","37400744586269507507665060537948458306","203547331500832945056732272393820910981","178292279392662583976188720783623500800"]},"id":"ASB-A-508390497-c278b99e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}},{"digest":{"length":4738,"function_hash":"59871013428157506864551094048293824739"},"id":"ASB-A-508390497-dcd842f3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_handle_file_operations"},"deprecated":false},{"id":"ASB-A-508390497-dd909649","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_initialize_data"},"deprecated":false,"digest":{"function_hash":"182881868032438019024232192557046453396","length":263}},{"deprecated":false,"digest":{"function_hash":"238829896495985789989614165120954943846","length":480},"id":"ASB-A-508390497-ff26c9a0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_store_rx_buf"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/94657f5ab8bc9a31ff0e92e700e5df6c66a1da59"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508390497.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e"],"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libnfc-nci/src/nfa/include/nfa_nfcee_int.h"},"deprecated":false,"digest":{"line_hashes":["78736959399154066486234987610909216218","71208027509033197731387020223873420735","33486568881350148964836785445900787374","339045180244430350007169829030600411991"],"threshold":0.9},"id":"ASB-A-508390497-362da251","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e"},{"digest":{"length":1106,"function_hash":"326366401751346550915570579071458748986"},"id":"ASB-A-508390497-3734c06b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_store_cc_info"},"deprecated":false},{"deprecated":false,"digest":{"length":263,"function_hash":"182881868032438019024232192557046453396"},"id":"ASB-A-508390497-5700e721","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"function":"nfa_t4tnfcee_initialize_data","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"}},{"digest":{"function_hash":"328936099919140081861732982492506691034","length":433},"id":"ASB-A-508390497-768dbeb2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_check_sw"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"function":"nfa_t4tnfcee_handle_file_operations","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false,"digest":{"length":4738,"function_hash":"59871013428157506864551094048293824739"},"id":"ASB-A-508390497-96b0d74f","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"238829896495985789989614165120954943846","length":480},"id":"ASB-A-508390497-b9c7ba63","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"function":"nfa_t4tnfcee_store_rx_buf","file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["152157930526192536816128854896592118813","41613029812386409780486726470858370062","255047040492351171474959648047956413870","120618831608176963524129507322499430795","239323682890214605812839920791860537773","63508091743452867297962153855251936564","182513641982644911842618346493343550722","283141489562142883587521961977190670798","314636659477928114725597794269267462898","317275237890320327709779896453215065535","271766284008791160849007988890760000239","228259714493390032019869720930386221083","205530279414354508726942952982564313222","279114995263695159063249461220586944108","202211479654350378781470717503433303260","152002589675868104584121476169344682395","86406249618623962061271767447125711126","866470406131785392688925713048690960","82690023572716875996157835564090829317","67684167402024307573346775535430867162","65213219031797729827619534616832227722","76203405964321458413297565535813960487","97606039263880642799881588789716357758","146267266102257269357770808434906716355","180859710997240488392739946553067255335","8712647110912205825651204845187110755","126157536433089580938869777278768808817","37400744586269507507665060537948458306","203547331500832945056732272393820910981","178292279392662583976188720783623500800"]},"id":"ASB-A-508390497-e329340a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/760cb019461de52a31da9d038735abdd18b1e64e","target":{"file":"libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc","function":"nfa_t4tnfcee_free_rx_buf"},"deprecated":false,"digest":{"function_hash":"142659283415739987162837670383468492450","length":400},"id":"ASB-A-508390497-ebbc666b","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508390497.json"}}],"schema_version":"1.9.0"}