ASB-A-503557185

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-503557185.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-503557185
Aliases
  • A-503557185
  • CVE-2026-49884
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "276605177026192549682155916036735755676",
                    "18813264319421182842429066997647269415",
                    "269812291768778055780385010858457745315",
                    "47612022169556401003954377218902050430",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-858085f9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "197236501930189316576218672212305773135",
                "length": 3025
            },
            "id": "ASB-A-503557185-8c1c4e3f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/50df1ba6f310a3947ff257d5fee24bb2b371af0c",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "140771855070805022637955257069071751877",
                "length": 1515
            },
            "id": "ASB-A-503557185-0399c0a8",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738",
            "target": {
                "file": "src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "276605177026192549682155916036735755676",
                    "18813264319421182842429066997647269415",
                    "269812291768778055780385010858457745315",
                    "47612022169556401003954377218902050430",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-748cf512",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/5a99b04ef8b3fcf7f225993520a5ef3e0b82a738",
            "target": {
                "file": "src/nfc/tags/rw_mfc.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "276605177026192549682155916036735755676",
                    "18813264319421182842429066997647269415",
                    "269812291768778055780385010858457745315",
                    "47612022169556401003954377218902050430",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-2855e44b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "164559282213980509558864881922028492306",
                "length": 3045
            },
            "id": "ASB-A-503557185-3ea4b0ad",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/d4544123ea3b152053f9abcb95fd2a2833b8fb72",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "276605177026192549682155916036735755676",
                    "18813264319421182842429066997647269415",
                    "269812291768778055780385010858457745315",
                    "47612022169556401003954377218902050430",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-06b82fdd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "197236501930189316576218672212305773135",
                "length": 3025
            },
            "id": "ASB-A-503557185-ee1f1910",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/3904b9fac0f3773b25373896a6828cbe49e52db2",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "276605177026192549682155916036735755676",
                    "18813264319421182842429066997647269415",
                    "269812291768778055780385010858457745315",
                    "47612022169556401003954377218902050430",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-1932a88a",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "197236501930189316576218672212305773135",
                "length": 3025
            },
            "id": "ASB-A-503557185-b3ff427e",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/0903c609fb0e36312e6b25447b6643fb8d79edb7",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "95284131742854166556922549794758120622",
                "length": 1549
            },
            "id": "ASB-A-503557185-0ab15cd2",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae",
            "target": {
                "file": "src/nfc/tags/rw_mfc.cc",
                "function": "rw_mfc_handle_read_op"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "69655206144047763324627390974452071933",
                    "182064786210422084685966623093874170708",
                    "244708649787374183558574779578392251786",
                    "222158656605350524766876329048184061535",
                    "54781843149328907080592043715670447407",
                    "170883185260871902791738363897820123913",
                    "120616904625416001175921474562733008890",
                    "65966796913547699082383393680569635030",
                    "302216940305840752620410839986407042585",
                    "111119171691673354834636547081134703908",
                    "307859468586770214448927853251946059423",
                    "193233323340608752164704765986559187044",
                    "111275732646922159657224336231672813499",
                    "20235284682274191823267581995426420422",
                    "164875801887099318226631497437978374445",
                    "216120922335092149838654609748643070538",
                    "269007645675242652289343423548548410051",
                    "251011635336640036980823830930925547522",
                    "318085585267862951496864666866506085406",
                    "155472057958554937713590160580540954717",
                    "70110918374773347930911262741357874023",
                    "64779778843217230941735465465973207304",
                    "339533047638978539848081104435274426689",
                    "225158239060701749903097012198577329561",
                    "182701919630055983655299266047364710456"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-503557185-fef91ab8",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/d57b289a5db85440250a6a03ee8c75f76a9f0dae",
            "target": {
                "file": "src/nfc/tags/rw_mfc.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503557185.json"