ASB-A-508389055

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-508389055.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-508389055
Aliases
  • A-508389055
  • CVE-2026-28653
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-3439a3d8",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191225795765895193381764264358686169756",
                "length": 1658
            },
            "id": "ASB-A-508389055-5013473c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "118541546654778033272760680839796197195",
                "length": 2027
            },
            "id": "ASB-A-508389055-b925e665",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/a3c9d2138b59dca19d2c34b9ec956d8e8fe18dc4",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-22a465fd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "298544333010801987015700944758194455882",
                "length": 1641
            },
            "id": "ASB-A-508389055-22b5dc5d",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "9146007812321068284982584168091657450",
                "length": 2022
            },
            "id": "ASB-A-508389055-5308b8ae",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/bf29e233eb27985cb56e28053ed91fa494ef8874",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "86990937027718195526565406680970965898",
                "length": 1653
            },
            "id": "ASB-A-508389055-53eaf0ac",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-55fb0e5c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "9146007812321068284982584168091657450",
                "length": 2022
            },
            "id": "ASB-A-508389055-c32ffb66",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/fcbd146c1edfd4ae63bf0b5f3a0bc2c5ebf105f6",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "86990937027718195526565406680970965898",
                "length": 1653
            },
            "id": "ASB-A-508389055-1de7bfff",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "9146007812321068284982584168091657450",
                "length": 2022
            },
            "id": "ASB-A-508389055-9c5e16e8",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-e241ca38",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/650366fff14c9c9e4957b5c06dae433b8290389d",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "118541546654778033272760680839796197195",
                "length": 2027
            },
            "id": "ASB-A-508389055-03911e70",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191225795765895193381764264358686169756",
                "length": 1658
            },
            "id": "ASB-A-508389055-2b7f3121",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-52ae4fe9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/9063a3f55246422f0b3dd38ad86125b125e4aa53",
            "target": {
                "file": "libnfc-nci/src/nfc/tags/rw_t3t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "DoS"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "9146007812321068284982584168091657450",
                "length": 2022
            },
            "id": "ASB-A-508389055-4a779481",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_update_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "161795593754733754778583268307071686127",
                "length": 1658
            },
            "id": "ASB-A-508389055-9afef553",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc",
                "function": "rw_t3t_send_next_ndef_check_cmd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "246090627490318114846672241276697874193",
                    "88080322660163282342747813652489436677",
                    "69692733816598867409513442215214620512",
                    "72574805137619027114153188223265723324",
                    "203278942767076670190596356173633270785",
                    "152081389016516164934639148043263307894"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508389055-aed9ba49",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/nfc/+/2720f9f8622f6f7f2e39aa991aa6d44958b1d317",
            "target": {
                "file": "src/nfc/tags/rw_t3t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389055.json"