Android NFCEE CVE-2026-55261

Exploitation requires local access to an affected device: the attacker must already be able to run code on the device (e.g. an installed unprivileged or malicious app) to reach the vulnerable NFCEE Type-4-Tag receive-buffer handling in nfa_t4tnfcee_store_rx_buf. The core prerequisite is simply that this code path is reachable despite a missing permission check (CWE-862); the input does not describe any additional configuration toggle or feature that must be enabled. Limiting factors: the vector is local (AV:L), not remote; only Android 17, 16 and 16-qpr2 are listed as affected; and devices patched to the 2026-11-01 security patch level are not vulnerable. No user interaction and no prior privileges are required (UI:N/PR:N), which raises realistic risk once any foothold exists on the device.

Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U, C:H/I:H/A:H, base 8.4 High) describes a local, low-complexity flaw needing no privileges and no user interaction, with full code-execution impact - an attractive primitive for a local privilege-escalation chain (e.g. after a malicious or compromised app is already on the device). However, the exploitation-likelihood signals are low: EPSS is 0.11% (1st percentile), the CVE is NOT in CISA KEV, and no PoC or exploit reference appears in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), matching the low-likelihood/high-impact profile: prioritize in the normal monthly Android patch cycle rather than as an incident. One conflict to note: the input Tags include 'RCE', but the description and CVSS both state LOCAL escalation of privilege (AV:L) - treat this as local EoP, not remote code execution. EPSS being very low despite High severity is expected here because exploitation requires local access, which limits opportunistic/widespread attacks.

A low-privileged or malicious app already present on an affected Android device drives the NFCEE Type-4-Tag receive-buffer path (nfa_t4tnfcee_store_rx_buf); because a permission check is missing (CWE-862), the app reaches code it should not be able to and achieves code execution in a more-privileged context, with no user interaction. No public exploit code is available, so this is currently a theoretical-to-targeted local escalation primitive rather than a mass-exploited one.