CVE-2026-49884

CVE-2026-49884 is an out-of-bounds write in the function rw_mfc_handle_read_op (rw_mfc.cc) in Android's NFC stack, the component that handles read operations for MIFARE Classic (MFC) tags; the bug is caused by an incorrect bounds check. It is triggered when the device's NFC component processes crafted tag data, and the description states that exploitation requires no additional execution privileges and no user interaction, consistent with hostile NFC tag data being parsed without the user doing anything. A successful exploit yields local escalation of privilege on the affected device, letting an attacker gain higher privileges than they started with. Affected products include Android devices running the impacted NFC stack — in practice the broad base of NFC-equipped Android phones — though specific affected version ranges are not specified in the available data, with the fix delivered via the Android security update cycle (related coverage ties it to the September 2026 Android Security Update). There is currently no known exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Install the September 2026 Android security patch (or later) as soon as your device or OEM delivers it, and confirm the NFC-related fixes are included in the build. Until patched, disable NFC or avoid tapping untrusted MIFARE Classic cards/tags on affected devices. No public PoC, no KEV listing, and ~0.1% EPSS indicate low current exploitation risk, but patch promptly because the flaw requires no user interaction to exploit.