EUVD-2026-26982Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (qualcomm) · only source for this CVE.
CVSS VectorVendor: qualcomm
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
AnalysisAI
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device compromise. Low-privilege authenticated users can trigger memory corruption during performance counter deselect operations, gaining high-integrity code execution with kernel-level access. Qualcomm has released patches in their May 2026 security bulletin. EPSS data not yet available for this future-dated CVE; no confirmed active exploitation or public exploit code identified at time of analysis.
Technical ContextAI
This vulnerability stems from a use-after-free condition (CWE-416) in Qualcomm Snapdragon's performance monitoring subsystem. When the system executes a performance counter deselect operation, it attempts to copy data from a memory region that has already been freed, resulting in memory corruption. Performance counters are privileged hardware features typically accessed through kernel-mode drivers for system profiling and diagnostics. The vulnerability exists in the kernel-space driver code handling these performance monitoring operations. The affected CPE indicates broad impact across Qualcomm Snapdragon product lines, which power billions of Android devices and embedded systems. Use-after-free vulnerabilities are particularly dangerous in kernel contexts because they allow attackers to control freed memory allocations and redirect execution flow, bypassing security boundaries between user-space and kernel-space.
RemediationAI
Apply patches released in Qualcomm's May 2026 Security Bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html. For Android device users, install firmware updates from device manufacturers (Samsung, Google, Xiaomi, etc.) that incorporate these Qualcomm patches once available through OEM security update channels. Enterprise mobile device management (MDM) administrators should prioritize deployment of May 2026 or later Android security patch levels. For devices that will not receive vendor updates (end-of-life models), implement compensating controls: restrict installation of applications to trusted sources only, enforce mobile threat defense solutions to detect exploit attempts, disable developer options and ADB debugging to reduce local attack surface, and consider device replacement for high-security environments where privilege escalation risks are unacceptable. Note that compensating controls only reduce but do not eliminate risk, as the vulnerability exists in chipset-level code that cannot be disabled without patching.
More in Snapdragon
View allBuffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to tr
Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-afte
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today