EUVD-2026-74008
GHSA-6qx6-pqfj-47mc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with low-privilege baseline access matches NFC service exploitation; no user interaction required; full CIA impact consistent with system-level privilege escalation.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Out-of-bounds write in Android's NFC MIFARE Classic read handler (rw_mfc_handle_read_op in rw_mfc.cc) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on the Android device with at least low-privilege access (PR:L) - a process running under any ordinary app sandbox UID qualifies. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 with AV:L correctly reflects that exploitation requires a running process on the target device - network-remote exploitation is not directly possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Google's September 2026 Android Security Bulletin patches (https://source.android.com/docs/security/bulletin/2026/2026-09-01); devices updated to the 2026-09-01 security patch level or later include the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Android device fleet to identify all devices running versions 14, 15, 16, 16-QPR2, or 17 and disable NFC capability on any devices where NFC is not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today