NXP NXPNfcRdLib EUVD-2026-94660

Exploitation targets the phalFelica module of NXP NXPNfcRdLib on RC663-based readers running versions up to 07.14.00_Pub, via API calls whose bounds checking is insufficient. Per the CVSS vector, the attacker must have local access (AV:L) and high privileges (PR:H) on the host, and must overcome high attack complexity (AC:H) - meaning specific memory-layout or timing conditions must align for the out-of-bounds access to succeed. These factors, combined with only Low CIA impact and the availability of a fix in 07.18.00+, sharply limit realistic risk: there is no remote unauthenticated path, and already-privileged local access is a precondition.

This is a low-priority vulnerability by every available signal. The provided CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L, base 3.9) describes a hard-to-reach, low-impact flaw: it requires local access, high attack complexity, and high privileges, and yields only limited (Low) loss of confidentiality, integrity, and availability. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no evidence of exploitation probability or in-the-wild activity; consequently the exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - a CWE-787 out-of-bounds condition in an embedded NFC reader library that an already-privileged local actor could trigger - with no conflict between the CVSS vector and the description, both of which point to constrained, non-remote exploitation. One nuance to note: the description also mentions 'an untrusted third party,' which could hint at a crafted-NFC-tag input path, but the CVSS PR:H/AV:L metrics indicate the practical attack surface is a privileged/local one, not an anonymous remote one. Net assessment: a genuinely low-severity, low-urgency issue, not a high-CVSS-but-low-real-risk case - it is simply low across the board.

An attacker who already holds high privileges on a device embedding NXPNfcRdLib (or who can feed crafted FeliCa data through the phalFelica module) supplies input that defeats the insufficient API bounds checking, causing an out-of-bounds memory access. Because attack complexity is high and only limited CIA impact results, the realistic outcome is reading or corrupting adjacent memory regions rather than full compromise. No public exploit code is identified at time of analysis.