CVE-2026-49885
7.8 HIGHPublished 2026-10-05 · Updated 2026-10-07
AI risk analysis
- Summary
- A buffer overflow vulnerability in Google's Android NFC implementation allows local attackers to escalate privileges without needing additional execution rights. The flaw occurs when updating files through the NFC reader/writer component.
- Exploitability
- Exploitation is relatively straightforward as it requires only local access with no user interaction needed, making it easy to leverage for privilege escalation.
- Blast radius
- The vulnerability affects Android devices with NFC capabilities, potentially allowing attackers to gain full system privileges on affected devices.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Apply the latest Android security patch update which includes the fix for rw_t4t_update_file in rw_t4t.cc
privilege-escalationnfcandroid
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-190
Vendors
Products
android
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-28625
- HIGHCVE-2026-28640
- HIGHCVE-2026-28641
- HIGHCVE-2026-28647
- HIGHCVE-2026-49880
- HIGHCVE-2026-49933
- HIGHCVE-2026-49937
- HIGHCVE-2026-55266
Related by shared AI tags and CWE weakness class. Browse the full archive.