{"id":"ASB-A-522373576","details":"In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-522373576","CVE-2026-55280"],"modified":"2026-10-05T16:56:05.998719076Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7"],"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7","target":{"function":"nfa_dm_notify_activation_status","file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"},"deprecated":false,"digest":{"function_hash":"332300021199806898276196870765038763319","length":2972},"id":"ASB-A-522373576-4206d6c7","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224483337144346899136422908731896199997","64214864829456873339004496189990021765","13163473448524578944396795731108758116","241491570255537996365097268142210973354"]},"id":"ASB-A-522373576-5b29e7bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7","target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"},"deprecated":false,"digest":{"line_hashes":["21168182341866304252807516392202603284","232049837176814702470155662855112554491","6084745176542985310750834481754092727","122479818102312198579909758974427360015","243410243930635723728979960076061328385","240405100430186187040148260853526688334","255739270963456306362760784403792887566","216399300597495014063020147027187701503","272113355203347937268749268958447048336","331253325747776485934187759077618550323"],"threshold":0.9},"id":"ASB-A-522373576-d5fe73e1","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-522373576-f0ab0b6f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f974b0fee85ff9910610f913e64df59c827cdaf7","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc","function":"nfc_ncif_proc_activate"},"deprecated":false,"digest":{"function_hash":"85417654253623690778142036628305194412","length":6214}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373576.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80","target":{"function":"nfa_dm_notify_activation_status","file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"},"deprecated":false,"digest":{"function_hash":"332300021199806898276196870765038763319","length":2972},"id":"ASB-A-522373576-668bb704","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc","function":"nfc_ncif_proc_activate"},"deprecated":false,"digest":{"length":6214,"function_hash":"85417654253623690778142036628305194412"},"id":"ASB-A-522373576-8538f4f5","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80","target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"},"deprecated":false,"digest":{"line_hashes":["21168182341866304252807516392202603284","232049837176814702470155662855112554491","6084745176542985310750834481754092727","122479818102312198579909758974427360015","243410243930635723728979960076061328385","240405100430186187040148260853526688334","255739270963456306362760784403792887566","216399300597495014063020147027187701503","272113355203347937268749268958447048336","331253325747776485934187759077618550323"],"threshold":0.9},"id":"ASB-A-522373576-f0044a6e"},{"target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"},"deprecated":false,"digest":{"line_hashes":["224483337144346899136422908731896199997","64214864829456873339004496189990021765","13163473448524578944396795731108758116","241491570255537996365097268142210973354"],"threshold":0.9},"id":"ASB-A-522373576-f6d1d7bd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/69e0da3fdbebcac18f6865136f1d76e71e579c80"],"severity":"Critical","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373576.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-522373576-2a4df616","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2","target":{"function":"nfc_ncif_proc_activate","file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"},"deprecated":false,"digest":{"function_hash":"85417654253623690778142036628305194412","length":6214}},{"deprecated":false,"digest":{"line_hashes":["21168182341866304252807516392202603284","232049837176814702470155662855112554491","6084745176542985310750834481754092727","122479818102312198579909758974427360015","243410243930635723728979960076061328385","240405100430186187040148260853526688334","255739270963456306362760784403792887566","216399300597495014063020147027187701503","272113355203347937268749268958447048336","331253325747776485934187759077618550323"],"threshold":0.9},"id":"ASB-A-522373576-34429e72","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2","target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"}},{"deprecated":false,"digest":{"line_hashes":["224483337144346899136422908731896199997","64214864829456873339004496189990021765","13163473448524578944396795731108758116","241491570255537996365097268142210973354"],"threshold":0.9},"id":"ASB-A-522373576-580c9fca","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}},{"target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc","function":"nfa_dm_notify_activation_status"},"deprecated":false,"digest":{"length":2972,"function_hash":"332300021199806898276196870765038763319"},"id":"ASB-A-522373576-f2faba17","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/0d0db90a39c373470f0b9c7e1559dc560c9103d2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373576.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc","function":"nfc_ncif_proc_activate"},"deprecated":false,"digest":{"length":6214,"function_hash":"85417654253623690778142036628305194412"},"id":"ASB-A-522373576-4750cba3"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56","target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc","function":"nfa_dm_notify_activation_status"},"deprecated":false,"digest":{"function_hash":"332300021199806898276196870765038763319","length":2972},"id":"ASB-A-522373576-9adf03ce"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224483337144346899136422908731896199997","64214864829456873339004496189990021765","13163473448524578944396795731108758116","241491570255537996365097268142210973354"]},"id":"ASB-A-522373576-d08ebc07","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56","target":{"file":"libnfc-nci/src/nfc/nfc/nfc_ncif.cc"}},{"digest":{"threshold":0.9,"line_hashes":["21168182341866304252807516392202603284","232049837176814702470155662855112554491","6084745176542985310750834481754092727","122479818102312198579909758974427360015","243410243930635723728979960076061328385","240405100430186187040148260853526688334","255739270963456306362760784403792887566","216399300597495014063020147027187701503","272113355203347937268749268958447048336","331253325747776485934187759077618550323"]},"id":"ASB-A-522373576-d3a27f04","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56","target":{"file":"libnfc-nci/src/nfa/dm/nfa_dm_act.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/afa6aacd8db5c44a06223dfd927b8758f6360b56"],"severity":"Critical","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373576.json"}}],"schema_version":"1.9.0"}