Out-of-Bounds Write Vulnerability in Android NFA NFCEE

CVE-2026-49880

What is CVE-2026-49880?

An out-of-bounds write vulnerability exists in multiple functions of nfa_nfcee_act.cc within Android's NFA NFCEE component. This flaw is attributed to a lack of proper bounds checking, which may allow local attackers to escalate their privileges on the device. Notably, this vulnerability can be exploited without requiring additional execution privileges or user interaction, making it a significant security concern for affected systems.

References