---
id: "CVE-2026-95400"
page: "https://infrastack.ai/live/CVE-2026-95400"
kind: "vulnerability"
aliases: ["CVE-2026-95400"]
title: "Android NFC driver: out-of-bounds write lets local apps gain elevated privileges"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "nfc", "st21nfc"]
not_affected_if: ["no-st21nfc-chip"]
published_at: "2026-11-10T20:19:47+00:00"
first_seen_at: "2026-11-10T20:46:16+00:00"
updated_at: "2026-11-10T20:49:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95400", "first_seen_at": "2026-11-10T20:46:16+00:00"}]
exploit_sources: []
---

# Android NFC driver: out-of-bounds write lets local apps gain elevated privileges

Link for people: https://infrastack.ai/live/CVE-2026-95400 (this .md is for agents)

A bounds check is missing in the NFC hardware write routine StNfc_hal_write in hal_st21nfc.cc, allowing an out-of-bounds write into global memory. An attacker with local code execution can escalate privileges without user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95400

## From the sources

In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_