The vulnerability resides in several functions within the Android NFC controller module source file nfa_nfcee_act.cc. A missing bounds check allows an out-of-bounds write, which can corrupt memory and overwrite critical data structures. The kernel of the issue is that the driver writes beyond the allocated buffer, and because it does not require any special execution privileges, an attacker who can trigger the code path gains a local privilege escalation. The write can overwrite values that control the driver’s state, enabling the malicious user to gain elevated privileges on the device. No user interaction or additional privileges are needed to exploit the flaw.

This flaw is present in the Android operating system’s NFC subsystem, specifically in modules compiled from the nfa_nfcee_act.cc source. The vendor involved is Google, and the affected product is Android, although no specific OS version is disclosed in the advisory. All devices that incorporate the NFC stack with the vulnerable code path are potentially impacted.

The CVSS score is not published, and an EPSS score is unavailable, so the exploitation probability remains uncertain. The issue is listed in CISA’s KEV catalog as not applicable, suggesting no widespread exploitation to date. Because the flaw only requires local access, its exploitation is limited to users who can directly interact with the NFC hardware or invoke the vulnerable driver functions. The lack of a need for elevated execution rights reduces the barrier to attack, yet the absence of user interaction and the privileged nature of the memory corruption make it a moderate‑to‑high risk for affected devices.