EUVD-2025-210027
GHSA-f9gj-4jh7-cm39
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (qualcomm) · only source for this CVE.
CVSS VectorVendor: qualcomm
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Memory Corruption when sending random number generator command with insufficient output buffer size.
AnalysisAI
Memory corruption in Qualcomm Snapdragon platforms allows a locally privileged attacker to trigger an out-of-bounds write by issuing a random number generator (RNG) command paired with an undersized output buffer, yielding complete confidentiality, integrity, and availability impact. The vulnerability requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H), placing the base score at 6.7 (Medium) despite the high C/I/A ratings. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-787 (Out-of-Bounds Write) is the root cause: when a caller issues an RNG command to the Snapdragon subsystem and provides an output buffer smaller than the data the command attempts to write, no bounds check is enforced, resulting in writes beyond the allocated buffer boundary. This class of defect commonly arises in firmware or trusted execution environment (TEE) interfaces where command dispatch handlers trust caller-supplied buffer sizes without validation. The affected component is the Qualcomm Snapdragon platform family (CPE: cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*), which spans a broad range of mobile and IoT SoCs. The wildcard CPE version field indicates Qualcomm has not publicly scoped the vulnerability to a discrete version range in available intelligence.
RemediationAI
Apply the update referenced in the Qualcomm June 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html). An exact patched firmware or software version is not confirmed in the available source data - patch availability is confirmed per vendor advisory, but the specific fix version should be verified against the bulletin and OEM downstream releases. Qualcomm patches typically reach end users through OEM device firmware updates (e.g., Android security patches), so device owners should apply the next available OEM system update incorporating the June 2026 Qualcomm security content. As a compensating control where patching is delayed, restrict access to privileged interfaces that invoke RNG commands - specifically limit which processes or users can invoke Snapdragon TEE or kernel-level RNG APIs. Note that this mitigation may impact applications relying on hardware-backed random number generation.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today