EUVD-2026-73980
GHSA-q5gm-xrvj-m9gj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with a low-privilege app required; logic error is straightforward to trigger once local; full device compromise upon successful memory corruption and privilege escalation.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already have local code execution on the device with at least low-privilege application-level access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent: local access with low-privilege access, low complexity, no user interaction, full confidentiality/integrity/availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply patches delivered via the September 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-09-01); the exact minimum Security Patch Level (SPL) string should be verified directly from the bulletin, as the available data does not specify it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of Android 14-17 devices in your mobile fleet and document NFC enablement status per device type. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today