CVE-2026-49879: NFC Stack RCE Vulnerability via Integer Overflow

CVE-2026-49879 Overview

CVE-2026-49879 is an out-of-bounds write vulnerability in the Android NFC stack, specifically within multiple functions of rw_t3t.cc. The flaw stems from an integer overflow that allows an attacker to write beyond the bounds of an allocated buffer. Successful exploitation can result in remote code execution without additional execution privileges. Google notes that user interaction is not required for exploitation, expanding the practical attack surface. The vulnerability affects the Type 3 Tag (T3T) NFC reader/writer implementation used by Android devices to communicate with FeliCa-based NFC tags.

Critical Impact
Remote code execution in the Android NFC subsystem with no user interaction, reachable by a network-adjacent attacker with low privileges.

Affected Products

Android platform components implementing the Type 3 Tag NFC reader/writer (rw_t3t.cc)
Devices covered by the Android Security Bulletin dated 2026-09-01
Android AOSP builds prior to the September 2026 security patch level

Discovery Timeline

2026-09-08 - CVE-2026-49879 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-49879

Vulnerability Analysis

The vulnerability resides in rw_t3t.cc, the Android NFC reader/writer implementation for Type 3 Tags. Multiple functions in this file perform arithmetic on attacker-influenced length or count fields before allocating or indexing into a buffer. When the arithmetic overflows an integer boundary, the resulting size is smaller than expected, and subsequent write operations exceed the true bounds of the allocation. This class of defect is classified as an out-of-bounds write [CWE-787] triggered by an integer overflow in the size computation. Because the NFC service runs with elevated system privileges on Android, memory corruption in this component can translate directly into remote code execution within a privileged process context.

Root Cause

The root cause is missing or insufficient validation of length values parsed from NFC tag response frames. Length fields supplied by a Type 3 Tag are used in size calculations without bounds checks that account for wraparound. When the computed size wraps to a smaller value, the destination buffer is undersized relative to the amount of data ultimately copied into it, corrupting adjacent heap memory.

Attack Vector

An attacker within NFC proximity, or one operating an emulated or malicious NFC tag, can present crafted Type 3 Tag responses to a target device. Because Android reads Type 3 Tag data automatically when NFC is enabled and a tag is detected, no user interaction beyond bringing the phone near the tag is required. The CVSS vector indicates a network-reachable attack path with low complexity. Refer to the Android Security Bulletin September 2026 for the vendor description of the affected functions and patched code paths.

Detection Methods for CVE-2026-49879

Indicators of Compromise

Unexpected crashes or tombstone files referencing libnfc-nci or symbols from rw_t3t.cc in /data/tombstones/.
NFC service (com.android.nfc) restarts or SIGSEGV/SIGABRT signals recorded in logcat near the time of tag interaction.
Devices reporting a security patch level earlier than 2026-09-01 while NFC is enabled.

Detection Strategies

Monitor mobile device management (MDM) telemetry for Android security patch level and flag devices below the September 2026 baseline.
Correlate NFC subsystem crashes with proximity events from enterprise-owned Android fleets to identify potential exploitation attempts.
Ingest Android logcat and tombstone artifacts into a centralized analytics pipeline for pattern analysis across the fleet.

Monitoring Recommendations

Track the Android Security Bulletin feed and alert when new bulletins reference NFC components.
Alert on repeated NFC service crashes on any managed device, which may indicate exploitation attempts against Type 3 Tag parsing.
Review physical access controls in environments where Android devices remain unlocked and NFC-enabled in public settings.

How to Mitigate CVE-2026-49879

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) to all managed devices.
Instruct users to disable NFC when not actively required, particularly in high-risk physical environments.
Enforce minimum Android patch level compliance through MDM policy and block non-compliant devices from sensitive resources.

Patch Information

Google addressed CVE-2026-49879 as part of the Android Security Bulletin September 2026. Device manufacturers integrate the AOSP fix into their vendor builds; end users receive the fix through carrier or OEM over-the-air (OTA) updates that raise the security patch level to 2026-09-01 or later. Verify remediation by checking Settings > About Phone > Android Security Update on each device.

Workarounds

Disable NFC in device settings until the September 2026 patch is installed.
Restrict use of Android devices with NFC enabled in untrusted physical environments such as transit hubs or public event spaces.
Segregate unpatched devices from access to sensitive enterprise applications until the fix is applied.

bash

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later

# Check NFC service status on a managed device
adb shell dumpsys nfc | grep -i "mState"