CVE-2026-49880

Summary

A buffer overflow vulnerability in Google's Android NFC implementation allows local attackers to write beyond allocated memory bounds, potentially enabling privilege escalation without requiring additional execution privileges or user interaction.

Exploitability

Exploitation is relatively straightforward as it requires only local access with existing user privileges, and no user interaction is needed for the exploit to succeed.

Blast radius

The vulnerability affects Android devices with NFC capabilities, potentially impacting a large portion of mobile users who have NFC enabled, making it a significant threat vector for privilege escalation attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the latest security patch update from Google that includes the fix for nfa_nfcee_act.cc, specifically targeting Android 14 and later versions where the vulnerability was introduced.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.