Android EUVD-2026-73980

The attacker must already have local code execution on the device with at least low-privilege application-level access (PR:L per CVSS vector). The NFC subsystem must be enabled on the device, which is the default on NFC-capable hardware. The vulnerable code path (rw_mfc_handle_read_op) is exercised during MiFare Classic NFC card read operations; triggering this from a local application may require either a physical MiFare Classic card to be presented or the ability to programmatically invoke the NFC read path from an app with appropriate permissions. No user interaction is required once local code execution is established (UI:N). Remote exploitation is not applicable (AV:L). SSVC rates the vulnerability as not automatable, ruling out mass remote exploitation. Exploitation is constrained to Android 14 through 17 on NFC-capable devices.

The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent: local access with low-privilege access, low complexity, no user interaction, full confidentiality/integrity/availability impact. SSVC rates Technical Impact as total but Exploitation as none and Automatable as no, which aligns with the very low EPSS of 0.14% - no active exploitation is occurring and mass-automated attacks are not feasible due to the local-access requirement. The principal risk tension is scope versus likelihood: five Android releases are affected (a massive install base), but reaching the vulnerable code path requires pre-existing local code execution at low privilege, limiting real-world exploitation to targeted attacks, malicious apps surviving Play Protect, or post-compromise lateral movement. This is a solid patch priority for managed enterprise fleets and high-risk targets; for the general consumer population the urgency is lower absent an exploit being published.

An attacker delivers a low-privilege malicious application to a target Android device - via sideloading, a compromised third-party store, or a Play Protect bypass - and executes code that interacts with the NFC subsystem to trigger the logic error in rw_mfc_handle_read_op, either by physically presenting a MiFare Classic card or by programmatically invoking the read path. The resulting out-of-bounds write corrupts adjacent memory structures, which the attacker then leverages to redirect execution and escalate to elevated Android system privileges. No public proof-of-concept exists at time of analysis.