ASB-A-503544522

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-503544522.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-503544522
Aliases
  • A-503544522
  • CVE-2026-49879
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-5d115385",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "216556653565837026106072784206893036256",
                "length": 2201
            },
            "id": "ASB-A-503544522-64b890f4",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "99904350508985959362138184529612643897",
                "length": 1832
            },
            "id": "ASB-A-503544522-8d53c016",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/241c49442390509f106f711ffcf11a476508898a",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-19fb6326",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218701892519819300876583624605778254242",
                "length": 2196
            },
            "id": "ASB-A-503544522-22f3593c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "75691722877044653702814369432102659368",
                "length": 1815
            },
            "id": "ASB-A-503544522-2562a99d",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/3f32bf32b1de00347e574ccbea7a534250b7d729",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218701892519819300876583624605778254242",
                "length": 2196
            },
            "id": "ASB-A-503544522-33db01b2",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "118518534350673920008214616083200694558",
                "length": 1827
            },
            "id": "ASB-A-503544522-68551ad9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-735ded7b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/e2f2976c60914c91320e4f699b73eb40cd114ee7",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218701892519819300876583624605778254242",
                "length": 2196
            },
            "id": "ASB-A-503544522-0be452df",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-b70015cf",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "118518534350673920008214616083200694558",
                "length": 1827
            },
            "id": "ASB-A-503544522-d78752f1",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/954d1df5a06b7b1f050ec10edd262ed7a345956e",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "99904350508985959362138184529612643897",
                "length": 1832
            },
            "id": "ASB-A-503544522-22ac514c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-8f62aefd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "216556653565837026106072784206893036256",
                "length": 2201
            },
            "id": "ASB-A-503544522-bd8889a0",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/f8909f95a729b02556a6c586df65e7fdf71921d1",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "211163091138098113796053825009973036484",
                "length": 1832
            },
            "id": "ASB-A-503544522-31086e28",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "189984837621850310110975076864452809522",
                    "275269099640824688943861808898075551164",
                    "273092356505764847811589229707029738664",
                    "59012381441273890035381551749975189539",
                    "249887260241018946617682373070684335526",
                    "73567017774454936399637097714619695095",
                    "240930093917411230762403688944671316267",
                    "225372919876756451930044416900407080054",
                    "5875318803596395521037915168271428169",
                    "294407273910681822995811832916545403849",
                    "307106181037280778747452343436327686927",
                    "31714584449132310925777600591957251043",
                    "268404567238755146179617935783543878489",
                    "100647088357377283931697442166930130805",
                    "109494137046170677588782775351196162230",
                    "18101888481829204235460331680300906270",
                    "55616108076678677775749903227770616582",
                    "137297109742395490921959261364390282151",
                    "125278997207605460688441014896820622010",
                    "12389236688042387261821281729922963100",
                    "308014487992032138473448094037074848919",
                    "296964935151634611401797594768129415236",
                    "319487828726553528062522187987219999549",
                    "13189931611366813464689741840227166482",
                    "207908552790060349622235792224899548340",
                    "110594160942549866687529658870715725260",
                    "286766766468884103814176012513692736471",
                    "236148969285571370065091053091974825472",
                    "296346521507879804972597197408129190699",
                    "139914124754410368207278756292801187179"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503544522-571dd7be",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218701892519819300876583624605778254242",
                "length": 2196
            },
            "id": "ASB-A-503544522-d8fb2780",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2da0e208d7a6ba0d4c8236b0d70d9a55ceabb08d",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503544522.json"