EUVD-2026-33825
GHSA-8wfg-43p7-wg28
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker needs low-privilege code execution (AV:L/PR:L) and must win a non-deterministic TOCTOU race (AC:H); memory corruption yields total C/I/A impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.
AnalysisAI
Local privilege escalation via memory corruption in Qualcomm Snapdragon chipsets arises from a time-of-check-to-time-of-use (TOCTOU) race condition where a shared buffer is read after a validation check while a concurrent user-mode thread modifies the underlying input. A local application holding low privileges can win the race window to corrupt kernel or firmware memory, achieving total loss of confidentiality, integrity, and availability on affected Snapdragon SoCs. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 3rd percentile), indicating no observed exploitation activity.
Technical ContextAI
The flaw is a CWE-367 (TOCTOU) race condition affecting shared memory buffers passed across the user-mode/kernel-mode boundary in Qualcomm Snapdragon platforms. Driver or firmware code validates the contents or bounds of a buffer, then re-reads that same shared buffer during processing; because the buffer remains mapped and writable by user space, a concurrent thread can alter it between the check and the use (a classic double-fetch), invalidating the earlier safety check and driving out-of-bounds or otherwise corrupted memory access consistent with the 'Buffer Overflow' tag. Affected CPEs span the Snapdragon family reported by Qualcomm, including compute SoCs (SC8380XP), audio codecs (WCD9380/WCD9385/WCD9378C), smart-speaker amplifiers (WSA8840/WSA8845/WSA8845H), and FastConnect connectivity subsystems (6900/7800), pointing to a driver/firmware interface reachable from user space rather than an application-level bug.
RemediationAI
Patch available per vendor advisory: apply the firmware/driver updates described in Qualcomm's June 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html) as delivered by your device OEM, since exact fixed build strings are provided there per-component and no single upstream version applies across the Snapdragon SKUs. Because fixes reach handsets and embedded devices through OEM ROM/firmware pipelines, prioritize installing the OEM security update that references the June 2026 Qualcomm bulletin. As compensating controls until the patch lands, restrict installation of untrusted local applications (the attack requires local code execution) and, where the platform supports it, tighten access to the affected driver interfaces so only trusted system processes can map the shared buffers; the trade-off is potential loss of functionality for apps that legitimately use those audio and connectivity paths. Independently verified fixed version numbers were not present in the provided data, so confirm exact builds against the vendor bulletin before deployment.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today