EUVD-2025-209224
GHSA-34mx-45mg-p6wm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
AnalysisAI
Local privilege escalation in Qualcomm Snapdragon components enables authenticated users to achieve arbitrary code execution with elevated privileges through memory corruption triggered by integer overflow during attestation report generation. The vulnerability requires low attack complexity and low-level authentication (CVSS:3.1/AV:L/AC:L/PR:L), allowing complete compromise of confidentiality, integrity, and availability on affected devices. With CVSS 7.8 (High severity) and local attack vector, this represents a significant risk on multi-user Android devices where malicious apps could exploit the flaw to break out of sandboxing. No public exploit identified at time of analysis, though the buffer overflow class (CWE-120) is well-understood by exploit developers.
Technical ContextAI
This vulnerability affects Qualcomm Snapdragon system-on-chip (SoC) components, specifically within attestation functionality that generates cryptographic reports to verify device integrity and trustworthiness. The root cause is a CWE-120 buffer overflow where an integer overflow during size calculations leads to insufficient buffer allocation before a copy operation. When the copy proceeds with the incorrectly calculated size, it writes beyond allocated memory boundaries, corrupting adjacent memory regions. Attestation report generation typically occurs in trusted execution environments (TEE) or privileged system services, making memory corruption in this context particularly dangerous as it may allow escape from security boundaries. The integer overflow likely occurs when multiplying or adding size parameters without proper bounds checking, a common pattern in buffer management code handling variable-length cryptographic structures.
RemediationAI
Apply firmware security updates provided in the Qualcomm April 2026 Security Bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. Qualcomm typically delivers patches to OEMs and ODMs who must integrate fixes into device-specific firmware builds, meaning end users should monitor their device manufacturer for Android security updates incorporating this patch. For enterprise deployments, prioritize updates for high-value targets like executive devices, kiosks with physical access, and BYOD environments where malicious app installation risk is elevated. Until patches deploy, implement compensating controls including restricting application installation to official app stores with Google Play Protect scanning, enforcing mobile device management policies that limit unknown source installations, and monitoring for privilege escalation attempts through endpoint detection. System administrators should inventory Snapdragon-equipped devices and track patch deployment through MDM platforms, prioritizing devices with high exposure to untrusted applications or physical access by multiple users.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today