Executive brief
A missing bounds check in Android's NFC routing component allows an attacker on a nearby device to write outside allocated memory and execute arbitrary code without needing user interaction or special permissions. This could allow a nearby attacker to take complete control of an Android device through proximity attacks.
Technical details
The checkUiccListenConfigNeeded function in RoutingManager.cpp fails to validate array bounds before writing, resulting in a heap-based out of bounds write. The vulnerability can be triggered remotely via adjacent network access (NFC proximity) and requires no elevated privileges or user interaction. Successful exploitation leads to arbitrary code execution.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched