Executive brief
Android's NFC subsystem contains an integer overflow vulnerability in the Type 3 Tag reader implementation that allows out-of-bounds memory writes. An attacker with local access to the device can exploit this flaw to escalate privileges without requiring additional system permissions or user interaction, potentially gaining full device control.
Technical details
The vulnerability exists in multiple functions within rw_t3t.cc, part of Android's NFC Type 3 Tag handling code. An integer overflow in size calculations leads to an out-of-bounds write condition. The attack is local in nature and requires no additional execution privileges or user interaction for successful exploitation. By crafting malicious NFC tag data or triggering specific NFC reader states, an attacker can write beyond allocated buffer boundaries, enabling privilege escalation. Patches addressing this issue are available in Android versions 14 and later, with updated AOSP releases referenced in the September 2026 security bulletin.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: Security patch level 2026-09-05 and later address this issue