CVE-2026-28653 Overview
CVE-2026-28653 is a high-severity out-of-bounds write vulnerability in the Android NFC stack. The flaw resides in multiple functions of rw_t3t.cc, the Type 3 Tag (FeliCa) reader/writer implementation. An integer overflow during length or offset calculations enables a write beyond the intended buffer boundary. Successful exploitation grants local escalation of privilege without requiring additional execution privileges or user interaction. The issue is tracked under [CWE-787: Out-of-bounds Write] and was addressed in the Android Security Bulletin September 2026.
Critical Impact
A local attacker with low privileges can trigger memory corruption in the NFC stack to escalate to elevated privileges on affected Android devices without user interaction.
Affected Products
- Android Open Source Project (AOSP) NFC subsystem — rw_t3t.cc
- Android devices receiving the September 2026 security patch level
- OEM Android builds incorporating the unpatched NFC stack
Discovery Timeline
- 2026-09-08 - CVE-2026-28653 published to the National Vulnerability Database (NVD)
- 2026-09-01 - Fix included in the Android Security Bulletin for September 2026
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28653
Vulnerability Analysis
The vulnerability affects the Type 3 Tag (T3T) reader/writer module in the Android NFC daemon. rw_t3t.cc handles response parsing for NFC-F FeliCa tag operations, including block reads, writes, and NDEF processing. Multiple functions in this file compute buffer sizes or offsets from attacker-influenced tag fields without validating the resulting integer arithmetic. When these values wrap around, the code writes past the end of a fixed-size buffer.
The write primitive executes in the context of the NFC process, which holds privileges beyond an unprivileged application. Successful memory corruption enables an attacker to hijack control flow or overwrite security-relevant state, achieving local escalation of privilege.
Root Cause
The root cause is an unchecked integer overflow used in a subsequent memory write operation, categorized as [CWE-787]. Length or block-count fields drawn from tag-supplied data are combined with header sizes or multipliers. When these arithmetic operations exceed the width of the storage type, the result underestimates the true allocation requirement. Downstream copy routines then write attacker-controlled bytes beyond the allocated destination.
Attack Vector
The attack vector is local. An adversary with the ability to influence NFC tag data processed by rw_t3t.cc can craft input that induces the overflow. Exploitation requires no user interaction and no additional execution privileges. The scope remains unchanged, and confidentiality, integrity, and availability are all impacted. Refer to the Android Security Bulletin September 2026 for the specific commit references and affected version ranges.
Detection Methods for CVE-2026-28653
Indicators of Compromise
- Unexpected crashes or tombstone files attributed to the com.android.nfc process referencing rw_t3t symbols.
- Kernel log entries showing SIGSEGV or SIGABRT in the NFC service during Type 3 Tag processing.
- Anomalous NFC activity on devices that do not typically use FeliCa or Type 3 Tag workflows.
Detection Strategies
- Monitor Android device logs for repeated NFC daemon restarts, which may indicate exploitation attempts against the T3T parser.
- Correlate mobile device management (MDM) telemetry to identify devices below the September 2026 security patch level (SPL).
- Inspect crash reports for stack frames within RW_T3tRead, rw_t3t_handle_ndef_detect_rsp, or related handlers.
Monitoring Recommendations
- Enforce minimum security patch level reporting through enterprise mobility management to flag non-compliant devices.
- Aggregate mobile crash telemetry into a centralized data lake to detect clustered NFC subsystem failures across the fleet.
- Alert on privilege escalation indicators such as unexpected new processes running under system UIDs following NFC activity.
How to Mitigate CVE-2026-28653
Immediate Actions Required
- Apply the Android September 2026 security patch level (SPL) or later on all managed devices.
- Identify devices that cannot receive the update and restrict their use in sensitive environments.
- Disable NFC on devices that do not require it, particularly those pending patch deployment.
Patch Information
The fix is documented in the Android Security Bulletin September 2026. OEMs incorporate the AOSP patch into their monthly security updates. Verify the security patch level under Settings → About phone → Android security update and confirm the value is 2026-09-01 or later. Enterprise administrators should push updates through their MDM platform and validate compliance across the fleet.
Workarounds
- Turn off NFC in device settings when it is not actively needed to reduce the attack surface.
- Avoid tapping or scanning untrusted NFC tags, stickers, or terminals.
- Apply MDM policies that disable NFC on high-risk device populations until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
