CVE-2026-57014

CVE-2026-57014 is an out-of-bounds write (CWE-787) in the function phNxpNciHal_ext_process_nfc_init_rsp within phNxpNciHal_ext.cc, part of the NXP NFC Hardware Abstraction Layer used on Android devices equipped with NXP NFC controllers. A missing bounds check while processing an NFC initialization response allows a malicious local actor, such as an untrusted app already on the device, to write past the end of a buffer with no user interaction and no additional execution privileges required. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). The issue was assigned by Google's Android vulnerability management team, indicating it is tracked in the Android security patch pipeline. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

What to do: Apply the Android security update that remediates CVE-2026-57014 as soon as the bulletin containing the fix is published, and verify devices are on the latest security patch level. Enterprises should inventory devices with NXP NFC chips and prioritize patching, since exploitation only requires a malicious local app and no user interaction. Restrict sideloading and untrusted app installation on managed Android devices as an interim hardening measure.