{"id":"ASB-A-524820424","details":"In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-524820424","CVE-2026-55277"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-524820424-26915236","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false,"digest":{"length":831,"function_hash":"58348224060187292585181118304767799829"}},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"]},"id":"ASB-A-524820424-9e6597e4","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"},"deprecated":false,"digest":{"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"],"threshold":0.9},"id":"ASB-A-524820424-a6168fa3","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false,"digest":{"function_hash":"58348224060187292585181118304767799829","length":831},"id":"ASB-A-524820424-ce9b5e5f","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"]},"id":"ASB-A-524820424-3ada677b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false,"digest":{"length":831,"function_hash":"58348224060187292585181118304767799829"},"id":"ASB-A-524820424-bf868c6c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}}],"schema_version":"1.9.0"}