Executive brief
Android's NFC (Near Field Communication) reader module contains a memory safety vulnerability that allows attackers to execute arbitrary code remotely without requiring user interaction or special privileges. This could allow an attacker with NFC proximity to a vulnerable device to compromise it and gain full control of the system.
Technical details
The vulnerability is a heap buffer overflow in the rw_mfc_handle_read_op function in rw_mfc.cc, a component of Android's NFC reader subsystem. The flaw allows an attacker to write data beyond the bounds of an allocated heap buffer through a crafted NFC message or interaction, potentially corrupting adjacent memory structures and achieving remote code execution. The vulnerability requires NFC proximity to the target device but no user interaction or additional execution privileges. Patches are available in Android versions 14 and later through the September 2026 security patch level (2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched