Android CVE-2026-58823

Requires a local attacker with low-privilege code execution on an Android 17 device that physically incorporates an STMicroelectronics NFC controller - devices using NXP or other NFC controllers do not include stpropnci_std.cc and are not affected. The attacker must be able to interact with the NFC subsystem from their process context, which is accessible to applications with standard app-level permissions. No user interaction is required after the malicious application is installed and invokes the vulnerable code path. Limiting factors include: local-only access (no remote exploitation path), specific ST NFC hardware dependency narrowing the vulnerable device population, and no automation of the exploit per SSVC Automatable rating of 'no.'

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the risk: exploitation is limited to local attackers with at least low-privilege code execution, reducing the attack surface compared to network-exploitable vulnerabilities. The AC:L metric indicates low complexity once local access is obtained, meaning no race condition or specific timing is required. SSVC rates Automatable as 'no,' consistent with the local-only vector and device-specific hardware prerequisite. Technical Impact is 'total,' confirming full compromise of the vulnerable system upon successful exploitation. EPSS data was not provided; exploitation status is 'none' per SSVC, meaning no public proof-of-concept or active exploitation has been observed. The hardware dependency on STMicroelectronics NFC controllers meaningfully narrows the population of vulnerable devices below the full Android 17 install base. Overall real-world priority is moderate: high severity for affected devices, but practically constrained by local-only access and specific hardware requirement.

A malicious application installed on an Android 17 device with an STMicroelectronics NFC controller executes with standard low-privilege app permissions and submits crafted ST-proprietary NCI protocol data targeting the stpropnci_process_std() function. The missing bounds check allows the crafted payload to overflow an internal buffer, corrupting adjacent memory in the NFC daemon or a privileged system process. The attacker leverages the corruption to redirect execution flow and achieve privilege escalation to a higher-privilege Android system context. No public exploit code has been identified at time of analysis.