Insufficient bounds checking in the phalFelica API of NXP NXPNfcRdLib RC663 through version 07.14.00_Pub could allow an attacker with privileges or an untrusted third party to read unintended memory regions, potentially leaking sensitive data, altering memory contents, or causing program instability, as classified by CWE‑787.

NXP’s NXPNfcRdLib product, specifically the RC663 module’s phalFelica interface, is vulnerable in all releases up to and including version 07.14.00_Pub. Versions starting with 07.18.00 have applied the fix and are no longer affected.

The CVSS score of 3.9 indicates a low‑severity vulnerability; the EPSS score is not available and the issue is not listed in CISA KEV. Exploitation requires the ability to invoke the phalFelica API, either through privileged code or by a trusted third party; the attacker would need to supply crafted parameters to cause an out‑of‑bounds read or write. While the impact is limited, the vulnerability could be used to compromise data confidentiality or program integrity in environments where the API is exposed to untrusted inputs.