CVE-2026-58823

CVE-2026-58823 is a memory safety bug in stpropnci_process_std of stpropnci_std.cc, part of the NFC/NCI stack shipped in Android; the component name indicates STMicroelectronics' proprietary NCI (NFC Controller Interface) extension, and the missing bounds check allows a classic buffer overflow (CWE-120). The flaw is triggered when the NFC stack processes crafted input, and exploitation requires only the ability to execute code locally on the device — no additional privileges and no user interaction are needed. A successful attacker gains local escalation of privilege, with a high-impact outcome for confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Affected are Android devices containing the vulnerable component, i.e., devices running security patch levels older than the September 2026 Android Security Update, which carries the fix. There is no evidence of exploitation so far: no public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Apply the September 2026 Android security update (the patch level issued with that bulletin or later) as soon as it reaches your devices, noting that OEM rollout timing varies and NFC-stack fixes often ship in vendor-specific updates rather than day-one OTA releases. There are no known workarounds, but limiting installation of untrusted apps reduces local attack surface. Enterprise defenders should inventory which managed devices use STMicroelectronics NFC silicon and prioritize those fleets for patching, monitoring OEM security advisories for the corresponding fix.