CVE-2026-28639

CVE-2026-28639 is an out-of-bounds write in rw_mfc_handle_read_op (rw_mfc.cc), the handler for MIFARE Classic tag read operations in the Android NFC stack, caused by a logic error in the code. It is triggered when the NFC subsystem processes MIFARE Classic read operations, and exploitation requires no user interaction and no additional execution privileges. A successful exploit corrupts adjacent memory and can lead to local escalation of privilege on the affected device. All Android devices running the vulnerable NFC code are affected; the flaw is addressed in the September 2026 Android Security Update. There is currently no public proof of concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.1%, so no exploitation is known.

What to do: Apply the September 2026 Android Security Update via OTA as soon as it is offered for your device, and verify the installed Android security patch level in Settings. Because this is a local privilege escalation with no known in-the-wild exploitation, treat it as routine patch hygiene, prioritizing fleets where users can install apps (e.g., enterprise/BYOD). As an interim precaution where patching is delayed, consider disabling NFC when not in use, since the flaw sits in the NFC tag read path.