CVE-2026-57014

Received Received - Intake

Out-of-Bounds Write in phNxpNciHal NFC Stack

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: Google Devices

Description

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-57014

EUVD

EUVD-2026-78993

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write issue in the phNxpNciHal_ext_process_nfc_init_rsp function of phNxpNciHal_ext.cc. It occurs because there is a missing bounds check, which could allow an attacker to write data outside the intended memory area.

Detection Guidance

This vulnerability involves a missing bounds check in phNxpNciHal_ext_process_nfc_init_rsp leading to a possible out-of-bounds write. Detection requires examining the NFC stack implementation for improper buffer handling. Review logs for crashes or memory corruption in NFC-related processes. Check for unusual NFC adapter behavior or system instability after NFC operations.

Impact Analysis

This vulnerability could allow a local attacker to escalate their privileges on the affected system. No additional execution privileges or user interaction are required for exploitation, making it easier to abuse.

Compliance Impact

This vulnerability could lead to local privilege escalation, potentially allowing unauthorized access to sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by increasing the risk of data breaches or unauthorized access to protected information.

Mitigation Strategies

Apply the latest security patches or updates from the vendor for the affected phNxpNciHal component. Disable NFC functionality if not required. Monitor vendor advisories for patches.

Hi! I’m here to help you understand CVE-2026-57014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70