CVE-2026-49882

CVE-2026-49882 is a heap buffer overflow in rw_mfc_handle_read_op (rw_mfc.cc), part of the Android NFC stack's handling of MIFARE Classic (MFC) tags. An attacker within NFC range can trigger the flaw by presenting a maliciously crafted MIFARE Classic tag to a device whose NFC reader processes it, with no user interaction and no privileges required. Successful exploitation can lead to remote code execution on the affected device. Android devices carrying the vulnerable NFC code are affected; the data does not specify exact version ranges, and the fix ships in the September 2026 Android security update per related reporting. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns it a low 0.2% probability of exploitation in the next 30 days, so no exploitation is known.

What to do: Apply the September 2026 Android security update (or the vendor build that includes it) as soon as it is available; check Settings > Security for the patch level rather than relying on a specific version number, which is not enumerated in the source data. As an interim mitigation, disable NFC when not needed and avoid bringing unknown NFC/MIFARE tags near unpatched devices. Monitor the Android Security Bulletin for the confirmed patched build list.