Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Android NFC code can be remotely hijacked

CVE-2026-49879 · published 2 months ago
Summary

The NFC (near‑field communication) component in Android may write data outside its intended memory area because of a calculation error. This allows an attacker on the network to run their own code on the device without needing any user interaction or extra permissions. Apply the latest Android security updates or patches that fix the NFC module as soon as possible.

What to do
  • Update google platform/packages/modules/nfc to version 17-next:2026-09-01.
  • Update google platform/system/nfc to version 15:2026-09-01.
  • Update google platform/packages/modules/nfc to version 16:2026-09-01.
  • Update google platform/packages/modules/nfc to version 16-qpr2:2026-09-01.
  • Update google platform/packages/modules/nfc to version 17:2026-09-01.
  • Update google platform/system/nfc to version 14:2026-09-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/modules/nfc >= 17-next:0, < 17-next:2026-09-01
>= 16:0, < 16:2026-09-01
>= 16-qpr2:0, < 16-qpr2:2026-09-01
>= 17:0, < 17:2026-09-01
Fix: upgrade to 17-next:2026-09-01
Android google platform/system/nfc >= 15:0, < 15:2026-09-01
>= 14:0, < 14:2026-09-01
Fix: upgrade to 15:2026-09-01
– google android 17
14.0
15.0
16.0
Original advisory text
In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User...
In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
ASB-A-503544522 · OSV
CVE-2026-49879 · NVD
CVE-2026-49879 · MITRE
Track software like this
Free during beta