ASB-A-508389908

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-508389908.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-508389908
Aliases
  • A-508389908
  • CVE-2026-28667
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:14Z
Summary
[none]
Details

In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "241606101154236611351144547570831723078",
                "length":  2069
            },
            "id":  "ASB-A-508389908-2425065e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "247575275074942422389668042042984432918",
                "length":  5836
            },
            "id":  "ASB-A-508389908-5932943b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-c3177328",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/5fdacfff0f153d63369252167961c1c6effb4a61",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-1cc43aab",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "148912054026218656259266199220089082747",
                "length":  5839
            },
            "id":  "ASB-A-508389908-69c8c25b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "163020249705269282834834175292665766155",
                "length":  2073
            },
            "id":  "ASB-A-508389908-8c8fe849",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/79bdfc5309fba1dbd245d75dd2dee8afb138824f",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-555dd614",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "241606101154236611351144547570831723078",
                "length":  2069
            },
            "id":  "ASB-A-508389908-55db527b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "247575275074942422389668042042984432918",
                "length":  5836
            },
            "id":  "ASB-A-508389908-a9db7983",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/2e81c83d82104cf8973c1b1f326c2f2a1227cb0c",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "247575275074942422389668042042984432918",
                "length":  5836
            },
            "id":  "ASB-A-508389908-0b458c3b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "241606101154236611351144547570831723078",
                "length":  2069
            },
            "id":  "ASB-A-508389908-0e78926e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-926fdc9d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/f22be7052913ce4cda46e03b44930601c5c4d9d0",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"
platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "247575275074942422389668042042984432918",
                "length":  5836
            },
            "id":  "ASB-A-508389908-23387fd7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-6db17c74",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "241606101154236611351144547570831723078",
                "length":  2069
            },
            "id":  "ASB-A-508389908-f8608147",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Nfc/+/104a741a53ac7b4ab685236ca2da2ca969c85d3d",
            "target":  {
                "file":  "libnfc-nci/src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"
platform/system/nfc

Package

Name
platform/system/nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "339441658170093803876067864557097210865",
                "length":  5890
            },
            "id":  "ASB-A-508389908-4a0105e3",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_update_ndef"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "177348562902949138904063912682500931962",
                    "57492838778411510434467684316563420948",
                    "332147715478840539317630616186270389476",
                    "271017236613013489803409497474361393240",
                    "7161245908265945562273808771275592227",
                    "324148222012212297227863312019149157563",
                    "184737047334161826504666475571841208445",
                    "211105018817416339579747681392884674988",
                    "129480160368503821644306826627310384512",
                    "201753248279537466005099585212510108055",
                    "238158208832183012314773904281397288685",
                    "40154651180071720170081376430105523207",
                    "21420892173950433543808113395097473704",
                    "55694857941154281040022956383759407674"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-508389908-8bd9a2b6",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "157353158569231971931011897701291974097",
                "length":  2124
            },
            "id":  "ASB-A-508389908-eeed0ff8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/nfc/+/9445095055b170c8ff300a47690ed3e9b8b1b0ab",
            "target":  {
                "file":  "src/nfc/tags/rw_t5t.cc",
                "function":  "rw_t5t_sm_set_read_only"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508389908.json"