EUVD-2025-209224
GHSA-34mx-45mg-p6wm
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
Analysis
Local privilege escalation in Qualcomm Snapdragon components enables authenticated users to achieve arbitrary code execution with elevated privileges through memory corruption triggered by integer overflow during attestation report generation. The vulnerability requires low attack complexity and low-level authentication (CVSS:3.1/AV:L/AC:L/PR:L), allowing complete compromise of confidentiality, integrity, and availability on affected devices. With CVSS 7.8 (High severity) and local attack vector, this represents a significant risk on multi-user Android devices where malicious apps could exploit the flaw to break out of sandboxing. No public exploit identified at time of analysis, though the buffer overflow class (CWE-120) is well-understood by exploit developers.
Technical Context
This vulnerability affects Qualcomm Snapdragon system-on-chip (SoC) components, specifically within attestation functionality that generates cryptographic reports to verify device integrity and trustworthiness. The root cause is a CWE-120 buffer overflow where an integer overflow during size calculations leads to insufficient buffer allocation before a copy operation. When the copy proceeds with the incorrectly calculated size, it writes beyond allocated memory boundaries, corrupting adjacent memory regions. Attestation report generation typically occurs in trusted execution environments (TEE) or privileged system services, making memory corruption in this context particularly dangerous as it may allow escape from security boundaries. The integer overflow likely occurs when multiplying or adding size parameters without proper bounds checking, a common pattern in buffer management code handling variable-length cryptographic structures.
Affected Products
Qualcomm Snapdragon system-on-chip components are affected, identified by CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*. The broad CPE wildcard indicates multiple Snapdragon SoC models and versions contain the vulnerable attestation code. Qualcomm has not publicly specified exact chip model numbers or firmware versions in available data, though their security bulletin architecture typically covers current-generation mobile, automotive, IoT, and compute platforms utilizing Snapdragon processors. Affected implementations include Android devices, Windows on ARM laptops, automotive infotainment systems, and IoT devices incorporating vulnerable Snapdragon firmware. The vendor advisory is documented at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html which should contain detailed affected product matrices and firmware build identifiers when published.
Remediation
Apply firmware security updates provided in the Qualcomm April 2026 Security Bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. Qualcomm typically delivers patches to OEMs and ODMs who must integrate fixes into device-specific firmware builds, meaning end users should monitor their device manufacturer for Android security updates incorporating this patch. For enterprise deployments, prioritize updates for high-value targets like executive devices, kiosks with physical access, and BYOD environments where malicious app installation risk is elevated. Until patches deploy, implement compensating controls including restricting application installation to official app stores with Google Play Protect scanning, enforcing mobile device management policies that limit unknown source installations, and monitoring for privilege escalation attempts through endpoint detection. System administrators should inventory Snapdragon-equipped devices and track patch deployment through MDM platforms, prioritizing devices with high exposure to untrusted applications or physical access by multiple users.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today