EUVD-2026-52731
GHSA-q56p-c5fr-4842
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Adjacent-only vector (AV:A) confirmed by NG-eCall radio/network context; no auth or interaction needed to intercept failed IPSec sessions; confidentiality-only impact matches information disclosure class.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
1DescriptionCVE.org
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
AnalysisAI
Information disclosure in Qualcomm Snapdragon chipsets exposes private data transmitted during NG-eCall SIP signaling when IPSec negotiation fails or is improperly established. Attackers adjacent to the network can intercept unprotected signaling traffic, gaining access to sensitive session data - potentially including location coordinates and caller identity transmitted as part of the automated emergency call system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
NG-eCall (Next Generation emergency Call) is the successor to the EU-mandated eCall system, enabling vehicles to automatically place emergency calls and transmit crash/location data over LTE/5G networks using SIP (Session Initiation Protocol) for session establishment. IPSec is the protocol layer responsible for encrypting and authenticating this signaling traffic between the vehicle telematics unit and the Public Safety Answering Point (PSAP) or IMS core. CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) identifies the root cause: when IPSec negotiation fails or is not established correctly, SIP signaling traffic that should be protected falls back to or transmits in an insufficiently protected state, leaking private information. The affected product is identified via CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* - a wildcard across all Snapdragon product lines, suggesting the flaw may affect multiple automotive or mobile Snapdragon variants with NG-eCall capability.
RemediationAI
Apply the security update detailed in Qualcomm's August 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html). The bulletin is the authoritative source for patched firmware versions, as no exact fix version is enumerated in currently available NVD or reference data. For automotive deployments, OEMs integrating Snapdragon telematics units should coordinate with Qualcomm and their tier-1 suppliers to obtain and distribute updated firmware via OTA or dealer service updates. As a compensating control pending patch availability, network operators or automotive telematics platform operators could enforce strict IPSec policy requirements at the IMS/PSAP gateway, rejecting or alerting on unprotected SIP signaling from vehicle units - though this may affect emergency call availability and should be weighed carefully given the life-safety nature of eCall systems.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today