The vulnerability originates in the phNxpNciHal_ext_process_nfc_init_rsp function within the Android NFC HAL. An unvalidated argument causes an out‑of‑bounds write, which can overwrite arbitrary memory locations. This flaw allows an attacker to perform local privilege escalation without requiring any additional execution privileges. The impact may compromise system integrity and confidentiality by enabling malicious code to run with elevated privileges.

The flaw affects Google Android devices that include the vulnerable NFC HAL code. No specific device models or versions but the issue appears in the Android framework referenced in the 2026-09-01 security bulletin. All devices running the affected firmware are potentially impacted.

The CVSS score of 7.8 places the vulnerability in the high severity range. Because no user interaction is required and the flaw is local, the attack vector is readily exploitable by any privileged user or local attacker. The EPSS score is 0.00073 and the vulnerability is not listed in the CISA KEV catalog at this time. The lack of an additional privilege requirement means a local attacker can gain root-level access directly, making this a critical concern for device owners.