CVE-2026-49879

CVE-2026-49879 is an integer overflow in Android's NFC reader/writer code (rw_t3t.cc, the component that handles NFC Type 3/FeliCa tags) that results in an out-of-bounds write when the stack processes crafted tag data. An attacker can trigger it by getting the device to process malicious NFC data — most plausibly a nearby malicious NFC tag — with no user interaction and no special privileges required. Successful exploitation yields remote code execution in the context of the NFC service, though no public proof-of-concept or in-the-wild exploitation is currently known. Any Android device with NFC hardware is potentially affected, with the fix delivered through the September 2026 Android Security Update. EPSS currently estimates only a 0.2% probability of exploitation within 30 days and the flaw is not yet in CISA's KEV catalog.

What to do: Apply the September 2026 Android security update as soon as it is available and confirm the patched security patch level under Settings > About phone. No public exploit exists yet, so there is no urgent emergency, but patch promptly; as an interim mitigation, users can disable NFC when not in use. Defenders should watch for PoC releases given the no-interaction RCE primitive.