{"id":"CVE-2026-95400","kind":"vulnerability","aliases":["CVE-2026-95400"],"related":[],"title":"Android NFC driver: out-of-bounds write lets local apps gain elevated privileges","description":"In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A bounds check is missing in the NFC hardware write routine StNfc_hal_write in hal_st21nfc.cc, allowing an out-of-bounds write into global memory. An attacker with local code execution can escalate privileges without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","nfc","st21nfc"],"not_affected_if":["no-st21nfc-chip"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:47+00:00","first_seen_at":"2026-11-10T20:46:16+00:00","triaged_at":"2026-11-10T20:49:26+00:00","updated_at":"2026-11-10T20:49:26+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:49:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android NFC driver: out-of-bounds write lets local apps gain elevated privileges","impact":"high","summary":"A bounds check is missing in the NFC hardware write routine StNfc_hal_write in hal_st21nfc.cc, allowing an out-of-bounds write into global memory. An attacker with local code execution can escalate privileges without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","nfc","st21nfc"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local code gains elevated privileges on the device","analyst_note":"Identify affected Android builds and patch level from the NVD entry and the Android security bulletin; the sources give no versions or fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-st21nfc-chip"],"who_is_affected":"The flaw sits in the ST21NFC NFC hardware abstraction layer, a component of devices using that NFC chip. Exposure depends on whether a device ships this code; the sources do not name affected builds or versions. Only a local attacker with code already running on the device is described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4548,"output_tokens":466,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-95400':17A,20A 'addit':100C 'allow':41B 'android':1A,21B 'app':11A 'attack':52B 'bound':7A,26B,46B,79C,88C 'check':27B,89C 'code':55B 'could':91C 'cve':15A,18A 'driver':3A 'due':84C 'elev':13A 'escal':58B,95C 'execut':56B,101C 'exploit':110C 'gain':12A 'global':49B,82C 'hal':37B,65C 'hal_st21nfc.cc':40B,68C 'hardwar':33B 'incorrect':87C 'infrastructur':22B 'interact':62B,105C 'lead':92C 'let':9A 'local':10A,54B,94C 'memori':50B,83C 'miss':29B 'need':103C,108C 'nfc':2A,23B,32B 'out-of-bound':4A,43B 'possibl':72C 'privileg':14A,59B,97C,102C 'routin':35B 'st21nfc':24B 'stnfc':36B,64C 'trigger':75C 'user':61B,104C 'way':73C 'without':60B 'write':8A,34B,38B,47B,66C,80C","nicknames":[],"mitigations":[],"who_affected":"The flaw sits in the ST21NFC NFC hardware abstraction layer, a component of devices using that NFC chip. Exposure depends on whether a device ships this code; the sources do not name affected builds or versions. Only a local attacker with code already running on the device is described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","nfc","st21nfc","unknown"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95400':17A,20A 'android':1A 'app':11A 'bound':7A 'cve':15A,18A 'driver':3A 'elev':13A 'gain':12A 'let':9A 'local':10A 'nfc':2A 'out-of-bound':4A 'privileg':14A 'write':8A","search_b":"'allow':41B 'android':21B 'attack':52B 'bound':26B,46B 'check':27B 'code':55B 'escal':58B 'execut':56B 'global':49B 'hal':37B 'hal_st21nfc.cc':40B 'hardwar':33B 'infrastructur':22B 'interact':62B 'local':54B 'memori':50B 'miss':29B 'nfc':23B,32B 'out-of-bound':43B 'privileg':59B 'routin':35B 'st21nfc':24B 'stnfc':36B 'user':61B 'without':60B 'write':34B,38B,47B","search_c":"'addit':100C 'bound':79C,88C 'check':89C 'could':91C 'due':84C 'escal':95C 'execut':101C 'exploit':110C 'global':82C 'hal':65C 'hal_st21nfc.cc':68C 'incorrect':87C 'interact':105C 'lead':92C 'local':94C 'memori':83C 'need':103C,108C 'possibl':72C 'privileg':97C,102C 'stnfc':64C 'trigger':75C 'user':104C 'way':73C 'write':66C,80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95400","severity":null,"published_at":"2026-11-10T20:19:47+00:00","modified_at":"2026-11-10T20:19:47+00:00","first_seen_at":"2026-11-10T20:46:16+00:00","fetched_at":"2026-11-10T20:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}