{"id":"ASB-A-524820424","details":"In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-524820424","CVE-2026-55277"],"modified":"2026-10-26T15:52:18.574870702Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8181cc81e3000afaadf2ab707ac4cf672af66d41"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false,"digest":{"function_hash":"58348224060187292585181118304767799829","length":831},"id":"ASB-A-524820424-26915236","signature_type":"Function"},{"target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"},"deprecated":false,"digest":{"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"],"threshold":0.9},"id":"ASB-A-524820424-9e6597e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/b19f65e0b8b024e49387a2f566deaa1cf33d6316"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"]},"id":"ASB-A-524820424-a6168fa3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4"},{"digest":{"function_hash":"58348224060187292585181118304767799829","length":831},"id":"ASB-A-524820424-ce9b5e5f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/bf3232c59f65960b4c8c09319a2b2971cd80eaf4"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp"},"deprecated":false,"digest":{"line_hashes":["189140065657459750012225455148627765728","36337222718689286215108669494669910868","299706125118254246166655915796740778953","153306459320031275594926476194583677602"],"threshold":0.9},"id":"ASB-A-524820424-3ada677b","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/51f9711a559d8e80aa91c4dba339ca44738e55a8","target":{"file":"NfcNci/nci/jni/RoutingManager.cpp","function":"RoutingManager::checkUiccListenConfigNeeded"},"deprecated":false,"digest":{"function_hash":"58348224060187292585181118304767799829","length":831},"id":"ASB-A-524820424-bf868c6c","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-524820424.json"}}],"schema_version":"1.9.0"}