Android CVE-2026-49884

Exploitation requires local code execution on the Android device with at least low-privilege access (PR:L) - a process running under any ordinary app sandbox UID qualifies. No user interaction is required beyond the attacker having already established local execution. NFC must be enabled on the device, which is the default state on virtually all Android devices shipping with NFC hardware. Limiting factors: the AV:L constraint means a remote-only attacker cannot directly reach this vulnerability; they must first achieve separate local code execution (e.g., via a malicious app installation or another exploit). Android's Play Protect and app-install controls reduce the likelihood of the required initial-access step on consumer devices. The scope does not change (S:U), so the escalation is contained to the compromised device.

The CVSS 3.1 score of 7.8 with AV:L correctly reflects that exploitation requires a running process on the target device - network-remote exploitation is not directly possible. EPSS is very low at 0.12% (2nd percentile), and the SSVC framework rates exploitation as 'none' with automatable 'no', confirming no known threat-actor activity or automated exploitation tooling at time of analysis. SSVC's 'Technical Impact: total' aligns with the C:H/I:H/A:H CVSS metrics, reflecting full device compromise if the flaw is successfully triggered. The practical priority for most organizations is routine patch cadence: apply the September 2026 Android Security Bulletin at the next regular update cycle. The AV:L constraint means an attacker must first obtain local code execution through a separate initial-access vector before reaching this bug, which meaningfully raises the exploitation bar beyond the raw CVSS score suggests.

An attacker with a malicious application already executing on the target Android device - obtained via a separate initial-access vector such as a malicious app install - triggers MIFARE Classic NFC card read operations crafted to violate the bounds check in rw_mfc_handle_read_op. The resulting out-of-bounds write corrupts memory within the NFC service process, which an attacker can leverage to redirect execution and obtain elevated system privileges with full confidentiality, integrity, and availability impact on the device.