Out-of-Bounds Write in Android NFC Stack (rw_t3t) Enables Local Privilege Escalation
AI analysis
CVE-2026-28653 is an integer-overflow flaw in multiple functions of rw_t3t.cc, the component of Android's NFC reader/writer stack that handles NFC Type 3 tags (such as FeliCa), which causes an out-of-bounds write when the affected code processes crafted tag data. It is triggered when the NFC stack processes the malformed input, and exploitation requires no user interaction and no additional execution privileges. An attacker who can reach the vulnerable code gains local escalation of privilege on the device; given the component, the likely vector is processing of a nearby malicious NFC Type 3 tag. Any Android device carrying the affected NFC stack is potentially exposed, and the fix shipped in the September 2026 Android security update, though specific affected version ranges were not provided in the available data. There is currently no evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns roughly a 0.1% probability of exploitation within 30 days (2nd percentile).
What to do: Apply the September 2026 Android security patch as it becomes available through your device OEM's monthly security update, and verify devices are running a patch level that includes this fix. Until patched, minimize exposure by avoiding reads of untrusted NFC Type 3/FeliCa tags or disabling NFC where operationally feasible, and prioritize patching devices where untrusted apps run. Consult the Android security bulletin and your OEM advisory to confirm affected versions and patch availability for your fleet.
Affected
| Google (Android) Android NFC stack — rw_t3t.cc (NFC Type 3 tag reader/writer) | — |
Estimated exposure
mass≈1–3 billion Android devices (NFC stack ships on the vast majority of active Android handsets) — Estimate based on Android's active install base on the order of billions of devices and near-universal inclusion of the NFC reader stack on modern NFC-capable Android phones, though actual exploitation requires local/tag-proximity access…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.