CVE-2026-87726 Overview
CVE-2026-87726 is an out-of-bounds memory access vulnerability in the phalFelica module of NXP's NXPNfcRdLib for the RC663 contactless reader IC. The flaw stems from insufficient API bounds checking in versions up to 07.14.00_Pub. An attacker with local privileges, or an untrusted third party interacting with exposed APIs, can read or write memory outside intended regions. Exploitation can lead to limited loss of confidentiality, integrity, and availability on affected devices. NXP addressed the issue in software release 07.18.00 and later.
Critical Impact
Local attackers with elevated privileges can trigger out-of-bounds memory access in NFC reader library code, potentially compromising sensitive data on embedded devices.
Affected Products
- NXP NXPNfcRdLib for RC663 — all versions through 07.14.00_Pub
- phalFelica module within NXPNfcRdLib
- Embedded systems and NFC reader devices integrating the vulnerable library
Discovery Timeline
- 2026-10-08 - CVE-2026-87726 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-87726
Vulnerability Analysis
The vulnerability resides in the phalFelica component of NXP's NXPNfcRdLib, a library used to drive FeliCa card operations on the RC663 NFC reader IC. API functions in this module fail to adequately validate caller-supplied length or offset parameters before performing memory operations. As a result, specifically crafted inputs can push read or write accesses beyond allocated buffer boundaries. The weakness is classified under CWE-787: Out-of-bounds Write, indicating the possibility of writing to adjacent memory. The attack is constrained to local access and requires elevated privileges, limiting broad exploitability. However, embedded deployments where the library runs within a privileged firmware context remain exposed.
Root Cause
The root cause is missing or incomplete length validation on parameters passed into phalFelica APIs. Without enforced upper bounds, downstream buffer operations trust untrusted size values and overrun the intended memory region.
Attack Vector
An attacker invokes the vulnerable phalFelica API with carefully chosen arguments that bypass internal length assumptions. Because exploitation requires local access and high privileges, the realistic threat profile involves malicious firmware components, compromised co-processors, or chained local privilege escalation. Successful exploitation can disclose or corrupt memory adjacent to the targeted buffer.
No verified public proof-of-concept code is available at this time. For technical specifics, refer to the NXP community discussion on CVE-2026-87726.
Detection Methods for CVE-2026-87726
Indicators of Compromise
- Unexpected crashes, resets, or watchdog triggers in firmware that integrates NXPNfcRdLib
- Anomalous memory contents or corrupted state in regions adjacent to FeliCa transaction buffers
- Unusual NFC transaction patterns targeting FeliCa APIs with abnormal length fields
Detection Strategies
- Audit firmware build manifests to identify instances of NXPNfcRdLib at or below version 07.14.00_Pub
- Perform static analysis of integrator code to confirm safe parameter handling before calls into phalFelica APIs
- Fuzz FeliCa API entry points with boundary and oversized length values to surface regressions after patching
Monitoring Recommendations
- Instrument embedded devices with runtime integrity checks that detect out-of-bounds memory corruption
- Collect firmware crash telemetry and correlate reboots with NFC activity timestamps
- Track vendor advisories from NXP PSIRT for follow-on fixes and related CVEs
How to Mitigate CVE-2026-87726
Immediate Actions Required
- Inventory all products and firmware images containing NXPNfcRdLib and record their versions
- Upgrade NXPNfcRdLib to version 07.18.00 or later, which contains the fix
- Restrict local and privileged access to devices running vulnerable firmware until patches are deployed
Patch Information
NXP has fixed the vulnerability in NXPNfcRdLib release 07.18.00 and all subsequent versions. Integrators should rebuild and redistribute firmware images that embed the library. Coordinate with NXP support via the NXP Product Security Vulnerability Information page for release artifacts and integration guidance.
Workarounds
- Enforce strict validation of all caller-supplied length and offset parameters in integrator code before invoking phalFelica APIs
- Reduce the privilege level of components that interact with the NFC stack where feasible
- Disable or gate FeliCa functionality on devices where it is not required pending firmware upgrade
# Configuration example
# Verify integrated NXPNfcRdLib version in a firmware build tree
grep -R "NXPNFCRDLIB_PRODUCT_VERSION" ./src/
grep -R "NXPNFCRDLIB_PRODUCT_MINOR" ./src/
# Confirm the resulting version is >= 07.18.00 before release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
