EUVD-2026-41926
GHSA-v9qv-qmj7-ghvr
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Local vector and high complexity reflect parser access requiring crafted memory conditions; scope change consistent with Snapdragon isolated subsystem architecture.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
1DescriptionCVE.org
Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.
AnalysisAI
Out-of-bounds write in Qualcomm Snapdragon's JPEG command parser exposes local low-privilege users to memory corruption via crafted JPEG input. Validation checks within the parser fail to account for extra buffer writes, overwriting adjacent memory and enabling a scope change beyond the vulnerable component's boundary - consistent with Snapdragon's isolated subsystem architecture (DSP, camera ISP). Qualcomm disclosed this in its July 2026 Security Bulletin; no public exploit identified at time of analysis.
Technical ContextAI
CWE-787 (Out-of-bounds Write) describes the root cause: during JPEG command parsing, validation logic underestimates the number of bytes written to the destination buffer, allowing writes past the allocated region. This is a classic off-by-more write overflow in a media processing pathway. The CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* with a wildcard version field indicates the flaw spans the Snapdragon product family broadly. The CVSS scope-change flag (S:C) implies the JPEG parser runs within a sandboxed subsystem - plausible for Qualcomm's Hexagon DSP or camera ISP - from which memory corruption can escape into adjacent memory regions controlled by a higher-privilege component. The local attack vector (AV:L) confirms this is not a remotely reachable parser path but one accessible through a local interface such as a camera HAL, codec service, or media framework API.
RemediationAI
Apply the security update published in the Qualcomm July 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html); the bulletin contains chipset-specific patch details. Patch available per vendor advisory - exact patched firmware versions are enumerated in the bulletin and must be obtained through OEM device update channels, as Qualcomm delivers fixes via OEM integration rather than direct end-user packages. As a compensating control where patching is not immediately possible, restrict untrusted application access to camera and media codec APIs at the Android permission or SELinux policy layer to reduce attacker ability to supply crafted JPEG data to the vulnerable parser; note this may degrade third-party camera or image-processing application functionality. Prioritize patching on devices processing untrusted media content or in high-value enterprise and government deployments.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today