CVE-2026-28639 Overview
CVE-2026-28639 is an out-of-bounds write vulnerability in the rw_mfc_handle_read_op function of rw_mfc.cc, a component of the Android Near Field Communication (NFC) stack. A logic error in the read operation handler allows memory to be written beyond an allocated buffer. Successful exploitation results in local escalation of privilege without requiring additional execution privileges. Exploitation does not require user interaction, which increases the practical risk on affected devices. The issue is tracked under [CWE-693: Protection Mechanism Failure] and is addressed in the Android Security Bulletin September 2026.
Critical Impact
A local attacker can escalate privileges on affected Android devices without user interaction by triggering malformed NFC read operations.
Affected Products
- Android platform component rw_mfc.cc (NFC MIFARE Classic read handler)
- Android versions referenced in the September 2026 Security Bulletin
- Devices shipping the affected Android NFC stack
Discovery Timeline
- 2026-09-08 - CVE-2026-28639 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28639
Vulnerability Analysis
The defect resides in rw_mfc_handle_read_op, the routine responsible for processing MIFARE Classic tag read operations within the Android NFC Reader/Writer subsystem. A logic error in the code path allows the function to write past the bounds of a fixed-size buffer during response handling. Because the NFC service runs with elevated privileges relative to unprivileged applications, memory corruption in this component provides a stepping stone for local privilege escalation. The attacker must already have local access to the device but does not need any user interaction to reach the vulnerable code path.
Root Cause
The root cause is a logic error rather than a missing length check on external input. The handler makes incorrect assumptions about the state or size of data returned from an NFC read operation, and subsequent writes exceed the allocated buffer. This maps to [CWE-693], where an intended protection mechanism does not function as designed, permitting memory beyond the target region to be modified.
Attack Vector
Exploitation is local. An attacker with the ability to influence NFC read operations, for example through a co-located malicious application or a crafted tag reachable by the reader, can steer the handler into the faulty logic path. Once out-of-bounds memory is written, control-flow hijacking or corruption of adjacent security-relevant state becomes feasible, elevating privileges within the Android security model.
No public proof-of-concept code has been released. See the Android Security Bulletin September 2026 for the authoritative technical description and patch references.
Detection Methods for CVE-2026-28639
Indicators of Compromise
- Unexpected crashes or tombstones referencing the NFC service (com.android.nfc) or the rw_mfc module
- Kernel or logcat entries showing SIGSEGV or SIGABRT in the NFC process shortly after tag interaction
- Installation of applications requesting NFC permissions outside of expected enterprise baselines
Detection Strategies
- Monitor mobile device management (MDM) telemetry for devices running Android builds that predate the September 2026 security patch level
- Inspect crash reporting pipelines for repeated faults in the NFC stack, which may indicate exploitation attempts
- Correlate NFC service restarts with the launch of newly installed or untrusted applications
Monitoring Recommendations
- Enforce a minimum security patch level policy through MDM and block enrollment of non-compliant devices
- Collect and centralize Android bug reports and logcat data from managed devices for retrospective analysis
- Track application install events that request android.permission.NFC and review anomalous grants
How to Mitigate CVE-2026-28639
Immediate Actions Required
- Apply the September 2026 Android security patch level to all affected devices as soon as vendor updates are available
- Disable NFC on devices that do not require it, particularly on unpatched builds
- Restrict installation of untrusted applications, especially those requesting NFC access
Patch Information
Google addressed the issue in the Android Security Bulletin September 2026. Device manufacturers integrate the fix into their own security patch levels. Confirm that managed devices report the September 2026 or later Android security patch level under Settings before considering remediation complete.
Workarounds
- Turn off NFC in system settings on devices awaiting vendor patches
- Limit physical access to devices in high-risk environments to reduce local attack opportunities
- Enforce MDM policies that block sideloading and restrict application sources to vetted stores
# Verify current Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Disable NFC via MDM-managed setting (example, requires appropriate permissions)
adb shell settings put global nfc_on 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
