ASB-A-508389525

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-508389525.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-508389525
Aliases
  • A-508389525
  • CVE-2026-49885
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:14Z
Summary
[none]
Details

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "103091566937678522282844264288623708687",
                    "191151558181188590818737145567309086363",
                    "335436876511915462234360019941570763019",
                    "140682489901787050342482012662202944872"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-62c9aafe",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254424311338487826953687272418942774638",
                "length":  1691
            },
            "id":  "ASB-A-508389525-c9a099b2",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/4df66fc917921cd049e0c4fd82e4c040729a9004",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "51677066153257995893180145516056973907",
                "length":  1659
            },
            "id":  "ASB-A-508389525-0363b8f0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "44144582395972112694978019736842380219",
                "length":  2784
            },
            "id":  "ASB-A-508389525-03e5eb77",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_set_ber_tlv"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "146075879696261318675728884483768664675",
                    "239430720755697664560393316713181674970",
                    "86477880180032255508241941027736048432",
                    "186567112422195530109700739012903177642",
                    "258599218062157932503827019374169621248",
                    "324247525830247675773301188317867602971",
                    "86477880180032255508241941027736048432",
                    "54329666249596431020854685688795608003",
                    "189073726553864912313849912779908340528",
                    "174492981312846775124732417380400088300",
                    "64104638798398007867226593861775759282",
                    "240417179533665351729169926213635455406"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-556b2d07",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/c4d4ef3f738ce9bd6cb5ccf2f23eef094d16cf10",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "146075879696261318675728884483768664675",
                    "239430720755697664560393316713181674970",
                    "86477880180032255508241941027736048432",
                    "186567112422195530109700739012903177642",
                    "258599218062157932503827019374169621248",
                    "324247525830247675773301188317867602971",
                    "86477880180032255508241941027736048432",
                    "54329666249596431020854685688795608003",
                    "103091566937678522282844264288623708687",
                    "191151558181188590818737145567309086363",
                    "335436876511915462234360019941570763019",
                    "140682489901787050342482012662202944872"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-734b0ac2",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "91760922202431221612969729817656673476",
                "length":  2780
            },
            "id":  "ASB-A-508389525-b63566f3",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_set_ber_tlv"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254424311338487826953687272418942774638",
                "length":  1691
            },
            "id":  "ASB-A-508389525-c1ed7171",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/88dbcd6f4560519314e2a689ce9ce4f78f48683a",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254424311338487826953687272418942774638",
                "length":  1691
            },
            "id":  "ASB-A-508389525-c53c06a5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "91760922202431221612969729817656673476",
                "length":  2780
            },
            "id":  "ASB-A-508389525-d6b9f94a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_set_ber_tlv"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "146075879696261318675728884483768664675",
                    "239430720755697664560393316713181674970",
                    "86477880180032255508241941027736048432",
                    "186567112422195530109700739012903177642",
                    "258599218062157932503827019374169621248",
                    "324247525830247675773301188317867602971",
                    "86477880180032255508241941027736048432",
                    "54329666249596431020854685688795608003",
                    "103091566937678522282844264288623708687",
                    "191151558181188590818737145567309086363",
                    "335436876511915462234360019941570763019",
                    "140682489901787050342482012662202944872"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-e454081d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/410ac6ec1243b505a6af6e5a20c5205e36ecf158",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254424311338487826953687272418942774638",
                "length":  1691
            },
            "id":  "ASB-A-508389525-0f75f9af",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "91760922202431221612969729817656673476",
                "length":  2780
            },
            "id":  "ASB-A-508389525-44b745e6",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_set_ber_tlv"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "146075879696261318675728884483768664675",
                    "239430720755697664560393316713181674970",
                    "86477880180032255508241941027736048432",
                    "186567112422195530109700739012903177642",
                    "258599218062157932503827019374169621248",
                    "324247525830247675773301188317867602971",
                    "86477880180032255508241941027736048432",
                    "54329666249596431020854685688795608003",
                    "103091566937678522282844264288623708687",
                    "191151558181188590818737145567309086363",
                    "335436876511915462234360019941570763019",
                    "140682489901787050342482012662202944872"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-6684bb8f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/6f500e02dda2ca267224403bbf84967f2063e9b7",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t4t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "168855280160394947439475255203909245399",
                "length":  1710
            },
            "id":  "ASB-A-508389525-0ab5f374",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_update_file"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "146075879696261318675728884483768664675",
                    "239430720755697664560393316713181674970",
                    "86477880180032255508241941027736048432",
                    "186567112422195530109700739012903177642",
                    "258599218062157932503827019374169621248",
                    "324247525830247675773301188317867602971",
                    "86477880180032255508241941027736048432",
                    "54329666249596431020854685688795608003",
                    "81385781804485318366228471590560471105",
                    "335921394151114656905020578621663601379",
                    "64104638798398007867226593861775759282",
                    "240417179533665351729169926213635455406"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389525-596cb777",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "68571072170501125657667726182242256979",
                "length":  2835
            },
            "id":  "ASB-A-508389525-be712eed",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/dc63a780afda1929a47b91ec42814677ab31b06e",
            "target":  {
                "file":  "src/nfc/tags/rw_t4t.cc",
                "function":  "rw_t4t_set_ber_tlv"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389525.json"