In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Nfc/+/d61d8a670948bfc392e748e07c0542b7b4d372ea"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"56839205020358411788645105757128807411",
"197344682762023495842856095429439661303",
"172158741106255470841394785895573122259",
"74930869978563375974736340739055967632",
"79655999883267746007653428499872417554",
"182516486746383234790015465126750476453",
"189322561129798853817660237309123262952"
],
"threshold": 0.9
},
"id": "ASB-A-503550880-80537b06",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/d61d8a670948bfc392e748e07c0542b7b4d372ea",
"target": {
"file": "libnfc-nci/src/nfc/tags/rw_ci.cc"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Nfc/+/52c49e79c36f296597310c68998810735393fd00"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"56839205020358411788645105757128807411",
"197344682762023495842856095429439661303",
"172158741106255470841394785895573122259",
"74930869978563375974736340739055967632",
"79655999883267746007653428499872417554",
"182516486746383234790015465126750476453",
"189322561129798853817660237309123262952"
],
"threshold": 0.9
},
"id": "ASB-A-503550880-03c9bf2b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/52c49e79c36f296597310c68998810735393fd00",
"target": {
"file": "libnfc-nci/src/nfc/tags/rw_ci.cc"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Nfc/+/a805221bcd8ff87b0ba507df2843331436861cae"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"56839205020358411788645105757128807411",
"197344682762023495842856095429439661303",
"172158741106255470841394785895573122259",
"74930869978563375974736340739055967632",
"79655999883267746007653428499872417554",
"182516486746383234790015465126750476453",
"189322561129798853817660237309123262952"
],
"threshold": 0.9
},
"id": "ASB-A-503550880-92698aa8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/a805221bcd8ff87b0ba507df2843331436861cae",
"target": {
"file": "libnfc-nci/src/nfc/tags/rw_ci.cc"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Nfc/+/e23770dba32e92ac7a8c6d372354fffd845d6df2"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"56839205020358411788645105757128807411",
"197344682762023495842856095429439661303",
"172158741106255470841394785895573122259",
"74930869978563375974736340739055967632",
"79655999883267746007653428499872417554",
"182516486746383234790015465126750476453",
"189322561129798853817660237309123262952"
],
"threshold": 0.9
},
"id": "ASB-A-503550880-1f1603cd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/e23770dba32e92ac7a8c6d372354fffd845d6df2",
"target": {
"file": "libnfc-nci/src/nfc/tags/rw_ci.cc"
}
}
]
}