In the rw_t4t_update_file function of rw_t4t.cc an integer overflow can cause an out‑of‑bounds write. The vulnerability does not require any user interaction or external execution privileges, and an attacker who can execute code locally on the device could exploit the overflow to write arbitrary data to memory and elevate their privileges to match the T4T service process.

Google Android is affected; the vulnerability exists in the T4T (NFC) component of the operating system. No specific Android release versions are listed in the CVE data, so all devices running the Android OS without the latest security patches may be vulnerable.

The CVSS score of 7.8 is provided and EPSS data is unavailable, but the impact is a local privilege escalation that can compromise device security. Based on the description, the likely attack vector is local code execution, as the vulnerability requires no user interaction and does not need additional execution privileges; this inference, however, is not explicitly stated in the CVE text. Any local user or attacker who has gained execution on the device can exploit the flaw. The vulnerability is not listed in CISA KEV, indicating that publicly known exploits may not yet exist, yet the potential for enterprise exploitation remains due to the severe local impact.