diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdcb72b34..c37572301 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,8 @@
* SubGHz: Add **Nord ICE** protocol (33 bits, Static)
* SubGHz: Add **CAME TOP44FGN** support in CAME TWEE protocol
* SubGHz: Add all 0x0s and all 0xFs KeeLoq MF codes for normal and simple learning
-* SubGHz: Fix CAME TWEE repeats count for button click
+* SubGHz: **Fix CAME TWEE repeats count for button click**
+* NFC: **Fix "MIR" and other EMV cards crash on Read** (by @Dmitry422)
* NFC: Add Mifare Ultralight C Write Support (by @haw8411)
* OFW PR 4362: NFC: Fix BusFault in Write to Initial Card (by @akrylysov)
* Apps: Build tag (**27mar2026**) - **Check out more Apps updates and fixes by following** [this link](https://github.com/xMasterX/all-the-plugins/commits/dev)
@@ -12,7 +13,6 @@
#### Known NFC post-refactor regressions list:
- Mifare Mini clones reading is broken (original mini working fine) (OFW)
-- While reading some EMV capable cards via NFC->Read flipper may crash due to Desfire poller issue, read those cards via Extra actions->Read specific card type->EMV
----
diff --git a/lib/nfc/helpers/iso14443_4_layer.c b/lib/nfc/helpers/iso14443_4_layer.c
index 4a92956a9..86bb25197 100644
--- a/lib/nfc/helpers/iso14443_4_layer.c
+++ b/lib/nfc/helpers/iso14443_4_layer.c
@@ -172,7 +172,10 @@ bool iso14443_4_layer_decode_response(
bit_buffer_copy_right(output_data, block_data, 1);
} else {
if(!bit_buffer_starts_with_byte(block_data, instance->pcb_prev)) break;
- bit_buffer_copy_right(output_data, block_data, 1);
+ // Fix for some EMV cards with strange response
+ if(bit_buffer_get_size_bytes(block_data) > 1) {
+ bit_buffer_copy_right(output_data, block_data, 1);
+ }
ret = true;
}
} while(false);
diff --git a/lib/toolbox/bit_buffer.c b/lib/toolbox/bit_buffer.c
index 36869bac2..e261e80d4 100644
--- a/lib/toolbox/bit_buffer.c
+++ b/lib/toolbox/bit_buffer.c
@@ -58,7 +58,6 @@ void bit_buffer_copy_right(BitBuffer* buf, const BitBuffer* other, size_t start_
furi_check(buf);
furi_check(other);
furi_check(bit_buffer_get_size_bytes(other) > start_index);
- // TODO: Fix crash
furi_check(buf->capacity_bytes >= bit_buffer_get_size_bytes(other) - start_index);
memcpy(buf->data, other->data + start_index, bit_buffer_get_size_bytes(other) - start_index);