CVE-2026-55277 Overview
CVE-2026-55277 is an out-of-bounds write vulnerability in the checkUiccListenConfigNeeded function of RoutingManager.cpp, a component of the Android Near Field Communication (NFC) stack. The flaw stems from a missing bounds check [CWE-120] and allows remote code execution over an adjacent network without user interaction. An attacker within proximity range can trigger the condition through the NFC interface to execute code with no additional privileges required. Google disclosed the issue in the Android Security Bulletin for September 2026.
Critical Impact
Proximal attackers can achieve remote code execution on affected Android devices through the NFC stack without user interaction, compromising confidentiality, integrity, and availability.
Affected Products
- Android Open Source Project (AOSP) — NFC subsystem
- Devices shipping the vulnerable RoutingManager.cpp component
- See the Android Security Bulletin September 2026 for the authoritative device and patch-level matrix
Discovery Timeline
- 2026-09-08 - CVE-2026-55277 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-55277
Vulnerability Analysis
The vulnerability resides in the checkUiccListenConfigNeeded function of RoutingManager.cpp, which manages NFC routing decisions for the Universal Integrated Circuit Card (UICC). The function writes data to a fixed-size buffer without validating the size of the input against the buffer boundary. When crafted NFC traffic reaches this routine, the write exceeds the allocated memory region and corrupts adjacent memory structures.
Successful exploitation results in remote code execution in the context of the process handling NFC routing. Because NFC processing runs with system-level privileges on Android, memory corruption in this path can lead to full compromise of the device's NFC stack and adjacent components. No user interaction such as tapping to confirm or unlocking the screen is required.
Root Cause
The root cause is a missing bounds check before a memory write operation, classified under [CWE-120] (Buffer Copy without Checking Size of Input). The checkUiccListenConfigNeeded routine trusts attacker-influenced length or index values when copying UICC listen configuration data into a destination buffer.
Attack Vector
The attack vector is Adjacent Network, meaning the attacker must be within NFC radio range of the target device, typically a few centimeters. An attacker crafts NFC frames or a rogue UICC-emulating device that triggers the vulnerable routing path. The vulnerable code processes attacker-controlled data before any application-layer authentication, so no user prompt or unlock action is required for exploitation.
See the Android Security Bulletin September 2026 for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-55277
Indicators of Compromise
- Unexpected crashes or reboots of NFC-related system services on Android devices
- Anomalous NFC service logs referencing RoutingManager or checkUiccListenConfigNeeded faults
- Devices reporting security patch levels earlier than the September 2026 Android Security Bulletin fix level
Detection Strategies
- Inventory managed Android devices against the September 2026 Android Security Bulletin patch level and flag devices below the fixed level
- Correlate mobile device management (MDM) telemetry with crash reports from the NFC subsystem to identify potential exploitation attempts
- Monitor for physical-proximity attack indicators such as devices exhibiting NFC service instability in shared or public environments
Monitoring Recommendations
- Ingest Android device patch-level attestation data into a centralized data lake for continuous exposure tracking
- Alert on NFC service crash signatures involving RoutingManager.cpp in mobile threat defense telemetry
- Track NFC usage baselines on high-value user devices and investigate deviations that align with proximity-based access patterns
How to Mitigate CVE-2026-55277
Immediate Actions Required
- Apply the September 2026 Android security patch level or later to all managed devices as soon as the OEM release is available
- Enforce minimum patch-level compliance through MDM policies and block non-compliant devices from sensitive resources
- Disable NFC on devices that cannot receive the patch and do not require NFC for business functions
Patch Information
Google addressed CVE-2026-55277 in the September 2026 Android Security Bulletin. The fix adds the missing bounds check in checkUiccListenConfigNeeded within RoutingManager.cpp. Device manufacturers must integrate the AOSP patch into their downstream builds; consult the Android Security Bulletin September 2026 for source patch references and the required security patch level string.
Workarounds
- Turn off NFC in device settings when not actively required for payments, transit, or pairing
- Avoid placing unpatched devices in close proximity to untrusted NFC readers, tags, or terminals
- Restrict use of unpatched devices in high-risk environments such as public transit hubs and conferences until the OEM patch is deployed
# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Confirm the returned value is 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
