EUVD-2026-41931
GHSA-wj36-3pgh-3jfq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
User-space process must issue crafted firmware commands (AV:L, PR:L); specific invalid index conditions required (AC:H); firmware boundary crossing with partial cross-component impact supports S:C and C:L/I:L/A:L.
Primary rating from Vendor (qualcomm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.
AnalysisAI
Memory corruption in Qualcomm Snapdragon firmware triggers an out-of-bounds write (CWE-787) when prepared commands are updated using invalid port indices supplied from user space that exceed supported read client limits. The vulnerability spans an exceptionally broad portfolio of Snapdragon chipsets covering mobile, automotive, XR/AR, and connectivity platforms. No public exploit has been identified at time of analysis, and CISA SSVC assessment rates exploitation as none and the flaw as non-automatable, though the changed scope (S:C) in the CVSS vector indicates impact can propagate beyond the directly vulnerable firmware component.
Technical ContextAI
The flaw resides in the Qualcomm Snapdragon firmware layer responsible for processing prepared commands issued from user space. The specific failure is a missing or insufficient bounds check on port index values before they are used to address memory structures, resulting in an out-of-bounds write classified under CWE-787. This pattern is characteristic of a hardware abstraction layer or DSP/subsystem driver where user-space-controlled input is passed into a firmware interface that trusts the caller to supply valid indices. The CPE string cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and the EUVD-2026-41931 listing confirm the scope encompasses virtually the entire Snapdragon portfolio. The CVSS Scope:Changed metric indicates the corruption can affect a security principal or component beyond the one handling the malformed command - consistent with firmware-level memory corruption that can cross isolation boundaries such as user-to-kernel or application processor-to-modem/DSP.
RemediationAI
Apply the firmware patches distributed through Qualcomm's July 2026 Security Bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html. No exact patched firmware version number was confirmed in available data; device-specific patch availability depends on OEM integration timelines, so users should contact their device manufacturer or monitor OTA update channels for Qualcomm-sourced security updates. If patching is delayed, restrict untrusted or third-party user-space applications from accessing the affected firmware command interface by tightening SELinux/SEAndroid policies or driver access controls - note this trade-off may affect legitimate applications relying on that interface. Enforce strict application sandboxing to minimize the population of low-privilege processes that can reach the vulnerable driver. Organizations managing fleets of Snapdragon-based Android or embedded devices should prioritize patching on internet-connected devices where local code execution by untrusted apps is a realistic threat.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today