EUVD-2026-41927
GHSA-m3mv-mgjg-xqg6
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Race condition requires local low-privilege access; scope change captures potential kernel memory corruption propagating beyond the vulnerable flash driver.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
1DescriptionCVE.org
Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.
AnalysisAI
Out-of-bounds write in Qualcomm Snapdragon's flash command handler allows a local low-privileged attacker to corrupt memory by exploiting a race condition between userspace LED count modifications and kernel-side flash command processing. The CVSS scope change (S:C) indicates the corruption can reach components beyond the immediately vulnerable driver - raising the potential for privilege escalation on affected Snapdragon-based devices. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-787 (Out-of-bounds Write) arising from a time-of-check/time-of-use (TOCTOU) pattern in the flash LED command subsystem. LED count values are sampled from userspace and used as bounds or indices during flash command processing; because userspace can modify these values after sampling but before use, a concurrent modification races the driver into consuming stale, attacker-controlled counts - causing an out-of-bounds write into adjacent kernel memory. The affected CPE (cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*) carries a wildcard on version, indicating Qualcomm has not restricted the scope to a single chipset generation. The tags 'Buffer Overflow' and 'Memory Corruption' are consistent with out-of-bounds write primitives that can overwrite heap or stack structures depending on driver memory layout.
RemediationAI
Apply patches provided through the Qualcomm July 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html); exact patched firmware or driver version numbers are not independently confirmed from the available data - consult the bulletin directly and follow up with the device OEM for platform-specific software updates. As a compensating control where patching is unavailable, restrict unprivileged local shell access by disabling ADB on production and end-user devices, and enforce SELinux policy to limit process access to flash LED device nodes - this addresses the PR:L and AV:L prerequisites the CVSS vector specifies. Note that tightening SELinux rules on flash device nodes may interfere with camera flash functionality and should be tested against device camera stacks before deployment.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today