Read the docs
TI-2026-69350 Aliases CVE-2026-87726GHSA-wc27-c63p-953m

Insufficient bounds checking in phalFelica API in NXP NxpNfcRdLib

Priority LOW 17CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NXP NxpNfcRdLib from RC663 before 07.18.00 has insufficient bounds checking in the phalFelica API. An attacker with privileges or an untrusted third party can reach unintended memory regions, which may limit confidentiality, integrity and availability. The flaw is an out of bounds write (CWE-787).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00098 0th percentileScored 2026-11-07
Fix Fixed NxpNfcRdLib (NXP): 07.18.00

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NXPNxpNfcRdLibRC663 to before 07.18.0007.18.00Patch availableCNA
  • NxpNfcRdLib VendorNXP Affected RC663 to before 07.18.00 Fixed in 07.18.00 Patch available CNA

Remediation

Update NXP NxpNfcRdLib to version 07.18.00 or later. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA NxpNfcRdLib (NXP) Fixed in 07.18.00

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-87726
  2. 2026-10-08 Alias added: GHSA-wc27-c63p-953m
  3. 2026-10-08 CISA SSVC decision points changed

References

Other 2

  • TI-2021-05573 NXP MQX Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2021-08911 NXP MCUXpresso SDK Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2019-10598 On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13063 The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does… CVSS 3.1HIGH 8.8
  • TI-2022-07063 NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and… CVSS 3.1HIGH 7.8
  • TI-2017-14764 Out-of-bounds write in NXP MQX Classic RTCS UDP recvfrom() CVSS 3.1MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences