EUVD-2026-78993
GHSA-xwpj-776g-xqr4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Google_Devices) · only source for this CVE.
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today