Android NFC Stack EUVD-2026-73985

Exploitation requires a process executing locally on the device with at least low-level (PR:L) privileges-an installed application is sufficient. The vulnerability is reachable through the NFC T3T processing code path; NFC does not need to be actively scanning an external tag, only the NFC service must be running and accessible to the calling app. No user interaction is required once the malicious app is running. Key limiting factors: the attacker must first obtain local code execution (e.g., via a separate app-install vector or initial compromise), the device must be running an affected Android version (14-17), and OEM-specific NFC stack variants may affect reachability. The AV:L designation confirms this is not a remote or over-the-air exploit-physical NFC proximity is not required.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) score accurately reflects a significant but local-only escalation: an attacker must already have a foothold on the device as a low-privileged process. The EPSS of 0.11% and 2nd-percentile ranking signal very low near-term exploitation probability, consistent with the absence of KEV listing and no known public POC. The real-world risk is nonetheless meaningful given Android's enormous deployment footprint-any vulnerability enabling LPE without user interaction is attractive as a post-exploitation stepping stone in multi-stage attack chains (e.g., combined with a browser sandbox escape). Attack complexity is rated Low, suggesting the overflow is straightforwardly reachable once local code execution exists. No conflicting signals: the AV:L assignment is consistent with the description's framing of 'local escalation of privilege.'

A threat actor delivers a malicious Android application-via phishing, third-party app store, or as a payload following a browser exploit-that, once installed with minimal permissions, interacts with the NFC service and submits crafted Type 3 Tag data structures containing values engineered to trigger an integer overflow in rw_t3t.cc. The overflow produces an out-of-bounds write into adjacent memory, corrupting kernel or process structures to redirect execution and gain system-level privileges with no further user action required. No public proof-of-concept is known at time of analysis.