Executive brief
Android's core system components include NFC transaction handling used for contactless payments and device communication. An integer overflow vulnerability in the rw_t3t.cc file allows attackers to write data beyond allocated memory boundaries, enabling remote code execution on affected devices without requiring user interaction or special privileges. This could allow an attacker to gain complete control of the device through malicious NFC communication.
Technical details
The vulnerability is an integer overflow in multiple functions within rw_t3t.cc (NFC Type 3 Tag handling) that leads to an out-of-bounds write condition. The flaw allows an attacker to send specially crafted NFC messages over the network that trigger the overflow, bypassing memory protection and enabling arbitrary code execution. The vulnerability requires no additional privileges and no user interaction for exploitation. Patches are available in Android security patch level 2026-09-05 or later, with fixes integrated into AOSP versions 14 through 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: Security patch level 2026-09-05 or later addresses this issue