CVE-2026-49882: Android NFC RCE Vulnerability

CVE-2026-49882 is a remote code execution flaw in Android NFC component caused by a heap buffer overflow in rw_mfc.cc. Attackers can exploit this without user interaction to execute arbitrary code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-49882 Overview

CVE-2026-49882 is a heap buffer overflow [CWE-122] in the rw_mfc_handle_read_op function of rw_mfc.cc, a component of the Android NFC (Near Field Communication) reader/writer stack for MIFARE Classic tags. The flaw allows remote code execution without user interaction and without additional execution privileges. The issue is addressed in the Android Security Bulletin dated September 2026.

Critical Impact
An attacker within NFC range can trigger a heap buffer overflow in the Android NFC stack, leading to remote code execution on the target device without any user interaction.

Affected Products

Android Open Source Project (AOSP) NFC stack
rw_mfc.cc component handling MIFARE Classic read operations
Android devices covered by the September 2026 security patch level

Discovery Timeline

2026-09-08 - CVE-2026-49882 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-49882

Vulnerability Analysis

The vulnerability resides in rw_mfc_handle_read_op, a function in the Android NFC subsystem responsible for processing read operations against MIFARE Classic tags. The function fails to correctly validate the size of data returned from an NFC read response before copying it into a heap-allocated buffer. When an attacker-controlled response exceeds the expected size, adjacent heap memory is overwritten.

Because the NFC service runs with elevated privileges within the Android system, corruption of its heap can be leveraged to redirect execution flow. The advisory classifies the impact as remote code execution with no additional execution privileges required.

Exploitation does not require user interaction. A crafted NFC tag or an NFC-capable device placed in proximity to the target can trigger the vulnerable code path when the reader initiates a read operation.

Root Cause

The root cause is a classic heap-based buffer overflow [CWE-122]. The rw_mfc_handle_read_op code path lacks a sufficient bounds check between the length field of an incoming MIFARE read response and the fixed-size destination buffer allocated on the heap. Malformed or oversized length values cause the memcpy-style operation to write past the buffer boundary.

Attack Vector

The attack vector is classified as network per the CVSS metric, reflecting that the NFC radio interface is treated as a remote channel. In practice, an attacker must be within NFC operating range, typically a few centimeters, of the target device with NFC enabled. Attack scenarios include a malicious NFC tag placed on a surface a victim taps, or a hostile NFC-capable device emulating a MIFARE Classic tag.

Because user interaction is not required and NFC polling occurs automatically on many devices, an unaware victim can be compromised simply by bringing the device near the attacker-controlled tag or emitter. The vulnerability manifests during response parsing, before any application-level acceptance of the tag contents. Refer to the Android Security Bulletin September 2026 for technical details.

Detection Methods for CVE-2026-49882

Indicators of Compromise

Unexpected crashes or tombstone files referencing the com.android.nfc process or libnfc native libraries
Repeated NFC service restarts recorded in logcat shortly after tag proximity events
Unexplained NFC tag read events on devices where NFC is not actively used by the operator

Detection Strategies

Monitor Android device patch levels and flag devices reporting a security patch level earlier than September 2026
Collect and inspect native crash reports from mobile endpoints for signatures involving rw_mfc_handle_read_op or heap corruption in the NFC process
Correlate NFC subsystem crashes with proximity events, physical location changes, or shared-space usage patterns

Monitoring Recommendations

Ingest mobile device management (MDM) compliance telemetry into the security data lake to track patch adherence across the Android fleet
Alert on NFC service crash loops or repeated native aborts in the NFC process
Track anomalous NFC activity on managed devices in high-risk environments such as public kiosks, transit hubs, and shared workspaces

How to Mitigate CVE-2026-49882

Immediate Actions Required

Apply the September 2026 Android security patch level or later to all managed Android devices
Instruct users to disable NFC when not actively required, particularly in public or untrusted environments
Enforce a minimum Android security patch level through MDM compliance policies and block or quarantine noncompliant devices

Patch Information

Google released a fix for this vulnerability as part of the September 2026 Android Security Bulletin. Devices must report a security patch level of 2026-09-01 or later to include the fix. Original equipment manufacturers (OEMs) distribute the patch through their standard update channels, and rollout timing varies by device vendor and carrier. See the Android Security Bulletin September 2026 for the authoritative list of fixes.

Workarounds

Disable NFC in device settings until the September 2026 patch is installed
Restrict device use in environments where untrusted NFC tags or emitters may be present
Use MDM policies to disable NFC on high-risk device fleets that cannot be immediately patched

bash

# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later

# Check NFC service status
adb shell dumpsys nfc | grep -i "mState\|SecurityPatch"