Google Android: Out-of-bounds write in NFC stack allows local privilege escalation
Summary
A High-severity flaw in the function rw_t4t_update_file in rw_t4t.cc of Android allows an out-of-bounds write caused by an integer overflow. A local attacker with low privileges, typically through a malicious or compromised app, could escalate privileges on the device without user interaction. No exploitation has been reported.
Affected
- Android 14, 15, 16, 16-QPR2 and 17 (per the Android Security Bulletin October 2026)
Fixed in
- Security patch level 2026-10-01 or later.
- Per-device availability and AOSP change numbers: Unknown.
Workaround
- Unknown. No workaround is documented in the sources reviewed. Apply the patch.
Exploitation
- No known exploitation in the wild, per the sources reviewed.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found; absence not confirmed.
Our recommendation
- Install the October 2026 security patch (2026-10-01 or later) on all Android devices, prioritising company-managed phones and tablets.
- Verify patch levels centrally with your MDM.
- Allow app installation only from managed sources and monitor for suspicious apps.
- Where NFC is not required, consider disabling it until the patch is installed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 source.android.com
- CVE-2026-49885 record (threatint mirror) cve.threatint.com
- CVE-2026-49885 CISA ADP vulnrichment (hol.org) hol.org
- Android October 2026 bulletin summary (Feedly) feedly.com
- Google October Android update critical vulnerabilities (eSecurityPlanet) www.esecurityplanet.com
- Android Security Advisory October 2026 (Canadian Centre for Cyber Security) www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:32.
Original description (NVD)
In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.