Executive brief
The NXP NCI HAL (NFC controller interface) contains a missing bounds check in the NFC initialization response handler that allows an out-of-bounds write. An attacker with local access can exploit this vulnerability to gain elevated privileges on the device without requiring any special permissions or user interaction.
Technical details
The vulnerability exists in the phNxpNciHal_ext_process_nfc_init_rsp function in phNxpNciHal_ext.cc, where insufficient bounds validation on write operations allows an attacker to write data beyond allocated buffer boundaries. This is a classic out-of-bounds write vulnerability that enables local privilege escalation. The function processes NFC controller initialization responses and lacks proper size checks before writing response data to memory. An attacker with local access can trigger this condition to corrupt memory and escalate privileges on the device. Patches are available through the Android security bulletin dated 2026-09-05 or later.
Affected products
- NXP NCI HAL <UNKNOWN>
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched