CVE-2026-28639 AI-generated analysis
platform/system/nfc (libnfc-nci), src/nfc/tags/rw_mfc.cc, MIFARE Classic (MFC) tag reader/writer; on Android 16/17 the same file is in platform/packages/modules/Nfc under libnfc-nci/
In rw_mfc_handle_read_op (MIFARE Classic NDEF read handling), the else branch that logs SafetyNet ID 178725766 for an NDEF length inflation attempt now also sets failed = true, so the read operation is marked as failed instead of continuing. Per the commit message, this prevents a heap out-of-bounds write.
Root cause
In rw_mfc_handle_read_op, the branch that detects an NDEF length inflation attempt only emitted android_errorWriteLog(0x534e4554, "178725766") and did not mark the operation as failed. The function then went on with its normal processing. Per the commit message, this allowed a heap out-of-bounds write. In the READ_NDEF path shown in the excerpt, data is copied into p_mfc->p_ndef_buffer up to p_mfc->ndef_length, and when that length has not been reached the next block is read. The exact condition of the patched branch and the buffer sizing are not visible in the material.
How the fix works
- src/nfc/tags/rw_mfc.cc:rw_mfc_handle_read_op: in the else branch that logs the length inflation attempt (android_errorWriteLog(0x534e4554, "178725766")), add 'failed = true;' so the operation is explicitly marked as failed. How the existing code acts on failed afterwards is not shown in full.
- Single-line, single-commit fix. The hunk is the same in all four majors; only the line number and, on 16/17, the file path differ.
Completeness
- Covers only the length-inflation else branch in rw_mfc_handle_read_op.
- The patch does not change how ndef_length is validated or rolled back in that branch. The code excerpt shows a different place (work_offset == 0 check) that already sets failed = true with an explicit roll back, so the full surrounding control flow of the patched branch is not visible.
- Other MFC paths (RW_MFC_STATE_DETECT_TLV, write paths, rw_nfc_decodeTlv) are not touched by this commit.
Behavior changes
- An MFC NDEF read that hits the length-inflation branch is now marked as failed instead of continuing. The SafetyNet log entry for 178725766 is still emitted. How the failure is reported to the caller is not shown.
Per major
- Android 14: same fix: platform/system/nfc e884267aee53 in android-security-14.0.0_r29 (cherry-pick of d43cc29f19da), src/nfc/tags/rw_mfc.cc line ~1060; 2/2 lines of the patched region present.
- Android 15: same fix: platform/system/nfc e22f0f7b91dd in android-security-15.0.0_r17, src/nfc/tags/rw_mfc.cc line ~1057; 2/2 lines present.
- Android 16: same fix, relocated: platform/packages/modules/Nfc ca73224fb2c2 in android-security-16.0.0_r8, libnfc-nci/src/nfc/tags/rw_mfc.cc line ~1292; 2/2 lines present.
- Android 17: same fix, relocated: platform/packages/modules/Nfc 9f4efdd67acb in android-security-17.0.0_r1, libnfc-nci/src/nfc/tags/rw_mfc.cc line ~1381; 2/2 lines present.
Unknowns
- The code excerpt (lines 1013-1072) does not contain the patched else branch. The if condition of that branch, and whether ndef_length is rolled back there, are not visible.
- How failed is handled later in the function, and how the failure reaches the caller (event/status), are not shown.
- How p_ndef_buffer is sized relative to ndef_length is not shown.
- How this relates to the earlier bug 178725766 referenced by the log ID is not described.
- The caller path and the exact tag interaction needed to reach the branch are not shown.