Low severity · published Oct 8, 2026
CVE-2026-87726
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended…
3.9
CVSS
0.1%
EPSS
No
On KEV
Description
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NX
NxpNfcRdLib · NXP
RC663 before 07.18.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87726
www.nxp.com
https://www.nxp.com/support/support/product-security-vulnerability:PSIRT
community.nxp.com
https://community.nxp.com/t5/Other-NXP-Products/NXPNfcRdLib-vulnerability-in-module-phalFelica-CVE-2026-87726/m-p/2414096#M33365