EUVD-2026-19339
GHSA-m3w8-q34w-8f9j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory Corruption when handling power management requests with improperly sized input/output buffers.
AnalysisAI
Memory corruption in Qualcomm Snapdragon components allows local authenticated users to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability through malformed power management requests. The vulnerability stems from improper validation of input/output buffer sizes in power management handlers. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV) or public exploit code identified at time of analysis. Qualcomm addressed this in their April 2026 security bulletin.
Technical ContextAI
This vulnerability affects Qualcomm Snapdragon chipset components (CPE: cpe:2.3:a:qualcomm,_inc.:snapdragon), specifically within power management subsystem handlers. The root cause is CWE-120 (Buffer Copy without Checking Size of Input), a classic buffer overflow condition. Power management interfaces in mobile System-on-Chip (SoC) architectures typically operate at elevated privilege levels to control hardware states, clock frequencies, and voltage regulators. When kernel or firmware components accept power management requests without properly validating buffer dimensions, attackers can supply oversized or undersized buffers that overflow adjacent memory regions. This can corrupt critical data structures, function pointers, or security tokens in kernel memory space. The local attack vector (AV:L) indicates the vulnerable code path is accessible through local system calls or device driver interfaces rather than network services.
RemediationAI
Organizations and end users should apply firmware updates from device manufacturers that incorporate fixes from Qualcomm's April 2026 security bulletin. The primary remediation is upgrading to patched Snapdragon firmware versions specified in the Qualcomm advisory at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. For enterprise-managed Android devices, administrators should verify OEM security patch levels include the April 2026 Qualcomm components and enforce update deployment through mobile device management (MDM) solutions. Consumer devices require users to install system updates from device settings when manufacturers release them, which may lag Qualcomm's disclosure by weeks or months depending on OEM validation processes. No effective workarounds exist for buffer overflow vulnerabilities in chipset firmware beyond limiting local access through strong authentication policies and restricting installation of untrusted applications that could serve as exploitation vectors. Devices that no longer receive manufacturer support cannot be remediated and should be replaced if used in security-sensitive contexts.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today