Android NFC CVE-2026-28667

Exploitation requires reaching the Android NFC Type 5 Tag reader/writer code (rw_t5t.cc) on an affected build (Android 14, 15, 16, 16-qpr2, or 17). Per the CVSS vector (AV:L/PR:L/UI:N), the trigger is a local, low-privileged context - such as an installed application able to exercise the NFC read path - and requires no user interaction and no additional execution privileges. The practical limiting factors are: the attacker must already have a foothold on the device (local vector, some privilege level), the impact is confined to reading memory (no write/execution), and NFC-related functionality must be reachable; because the component parses externally presented NFC tags, verify with Google whether a crafted physical Type 5 Tag in proximity can also reach the flaw, which would broaden the condition beyond a purely local app.

This is a moderate-severity, local information-disclosure flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes an out-of-bounds read reachable locally by a low-privileged context with no user interaction, yielding high confidentiality impact but zero integrity or availability impact - consistent with memory disclosure, not code execution. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation status is: no public exploit identified at time of analysis. The strongest mitigating signals are the local attack vector and the read-only (C:H/I:N/A:N) impact, which bound this to leaking memory contents rather than enabling takeover. One notable tension to verify: the affected code rw_t5t.cc is Android's NFC Type 5 Tag reader, which processes data from externally presented NFC tags - a proximity/physical input surface - yet Google assessed the vector as AV:L (local). This likely reflects Android's severity model, where a co-resident malicious app without special privileges (PR:L) reaches the vulnerable NFC parsing path locally; defenders relying on 'local-only' framing should confirm whether a crafted physical NFC tag can also trigger the read, as that would change the realistic exposure. Overall: patch in normal cadence; not a drop-everything issue absent evidence of active exploitation.

A low-privileged malicious app installed on an Android device (or data from a crafted NFC Type 5 Tag presented to the device) drives the vulnerable rw_t5t.cc parsing functions past their intended buffer bounds, causing an out-of-bounds read. The leaked adjacent memory may contain sensitive process data useful for defeating ASLR or harvesting secrets. No public exploit code is identified, and because the CVSS vector is AC:L/UI:N the trigger is low-complexity and needs no user interaction once the attacker can reach the NFC read path.