CVE-2026-59776: FeliCa IC Chip Information Disclosure Flaw

CVE-2026-59776 Overview

CVE-2026-59776 is a Missing Cryptographic Step vulnerability [CWE-325] affecting certain Sony FeliCa integrated circuit (IC) chips shipped in or before 2017. FeliCa is a contactless smart card technology used for transit fares, electronic money, and access control across Japan and other regions. An attacker with physical proximity to a vulnerable chip can read or tamper with data stored on the IC. The flaw stems from an omitted step in the cryptographic protocol used to protect stored information. Sony and JPCERT/CC have published coordinated advisories describing the impacted chip generations and mitigation guidance.

Critical Impact
An attacker with physical access to a vulnerable FeliCa IC chip can read or modify sensitive stored data, potentially compromising payment credentials, transit balances, and identity records.

Affected Products

Sony FeliCa IC chips shipped in or before 2017
Contactless cards, tokens, and embedded modules using the affected FeliCa chip generations
Third-party products incorporating vulnerable FeliCa IC chips as identified in the Sony advisory

Discovery Timeline

2026-07-21 - CVE-2026-59776 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-59776

Vulnerability Analysis

The vulnerability is classified as a Missing Cryptographic Step [CWE-325] in the protocol implemented by affected FeliCa IC chips. FeliCa protects stored data through a mutual authentication and session key derivation sequence between the card and the reader. When a required step in that sequence is skipped or improperly enforced, the resulting session does not provide the confidentiality and integrity guarantees the protocol was designed to deliver.

An attacker who can bring a reader device within radio range of a vulnerable chip may complete a truncated protocol exchange. Because the omitted step is part of the cryptographic chain that binds keys to the session, the attacker can either read protected blocks or write modified content back to the chip. The attack requires physical proximity but does not require authentication, user interaction, or elevated privileges on the target chip.

Root Cause

The root cause is an incomplete implementation of the cryptographic protocol on affected chip revisions. A step that should be part of key establishment or command authorization is not performed, weakening the trust boundary between the card and any device that speaks the FeliCa protocol. Full technical details are restricted to the coordinated advisories from Sony and JPCERT/CC.

Attack Vector

Exploitation requires a physical attack vector. The attacker must position an NFC-capable reader within the short operating range of the target FeliCa chip, typically a few centimeters. Once in range, the attacker issues protocol commands that exercise the incomplete cryptographic sequence to read or overwrite protected data blocks. No network access, no user interaction, and no prior credentials are needed.

See the JVN Security Advisory JVN40509781 and Sony Product Security Information for technical details on affected chip identifiers.

Detection Methods for CVE-2026-59776

Indicators of Compromise

Unexplained balance changes, transaction anomalies, or data mismatches on FeliCa-based cards or tokens
Physical evidence of card skimming devices or unauthorized readers placed near turnstiles, kiosks, or point-of-sale terminals
Backend reconciliation errors between issuer records and card-side stored values

Detection Strategies

Inventory deployed FeliCa cards and embedded modules and cross-reference chip generations against the affected list in the Sony advisory
Enable server-side transaction validation so that card-reported values are verified against authoritative backend records before actions are honored
Correlate physical access logs, reader telemetry, and issuer transaction logs to surface tampering attempts

Monitoring Recommendations

Log and alert on statistically improbable transaction patterns such as rapid balance top-ups, duplicate serials, or writes originating from unregistered readers
Monitor reader firmware and terminal integrity to detect rogue hardware installed in customer-facing environments
Track advisory updates from JPCERT/CC and Sony for revised lists of affected chip identifiers and remediation status

How to Mitigate CVE-2026-59776

Immediate Actions Required

Identify all deployed cards, tokens, and embedded products using FeliCa IC chips shipped in or before 2017
Contact Sony or the card issuer to confirm whether specific chip lots are affected and to obtain replacement guidance
Prioritize replacement of vulnerable chips used in high-value scenarios such as payment, transit, and physical access control

Patch Information

Because the vulnerability resides in the IC chip hardware and firmware, it cannot be remediated through a software update on deployed cards. Sony's advisory instructs affected operators to migrate to newer FeliCa chip generations that implement the complete cryptographic sequence. Refer to the Sony Product Security Information page for the authoritative list of unaffected replacement chips.

Workarounds

Enforce server-side authorization and value verification so the backend, not the card, is the source of truth for balances and entitlements
Reduce the value stored directly on affected cards and shift sensitive credentials to backend-resident records
Deploy tamper-resistant reader enclosures and inspect terminals regularly to detect unauthorized proximity readers
Rotate or revoke card-resident keys and reissue credentials on newer chip generations as replacements become available

bash

# Example: query an issuer inventory database for cards using affected FeliCa chip generations
# Replace placeholders with values from the Sony advisory
sqlplus -S issuer/xxxx@cardsdb <<'SQL'
SELECT card_serial, chip_model, issue_date, status
FROM   issued_cards
WHERE  chip_family = 'FeliCa'
AND    issue_date <= DATE '2017-12-31'
AND    chip_model IN ('MODEL_A','MODEL_B') -- from Sony advisory
ORDER  BY issue_date;
SQL