Google Android: Out-of-bounds write in NFC stack allows local privilege escalation
Summary
An out-of-bounds write caused by a missing bounds check in multiple functions of nfa_nfcee_act.cc in the Android NFC stack. A local attacker with an existing foothold on the device, such as a malicious app, could escalate privileges without additional execution privileges and without user interaction. The vendor rates the issue High in its October 2026 bulletin, and the CVSS base score in the input is 7.8.
Affected
- Android 16, 16-qpr2 and 17 (per the Android Security Bulletin, System component, AOSP column)
- Android 14 and 15 are not listed for this CVE
- Exact AOSP build numbers: Unknown.
Fixed in
- Security patch level 2026-10-01 or later (Android Security Bulletin—October 2026)
- Exact fixed AOSP builds: Unknown.
Workaround
- No vendor workaround known.
- Analyst suggestion, not from a source: where NFC is not required for business use, disable NFC until the device is patched. Verify the option against your MDM before relying on it.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- Google reports no in-the-wild exploitation for the October 2026 flaws.
- No public proof-of-concept found.
Our recommendation
- Update Android devices to security patch level 2026-10-01 or later.
- Check MDM reports for devices below this patch level and prioritise those used for company email and data.
- Replace devices that the manufacturer no longer supports.
- Verify the CVSS score and NVD status directly in the NVD record, as these could not be confirmed from the sources reviewed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 source.android.com
- Strix CVE-2026-49880 www.strix.ai
- HOL Guard CVE-2026-49880 (CISA ADP Vulnrichment) hol.org
- Appaloosa Scout Android 2026-10-01 scout.appaloosa.io
- Threatint CVE-2026-49880 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:32.
Original description (NVD)
In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.