EUVD-2026-41932
GHSA-685v-jj9g-mfg9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged app triggers the flaw with no user interaction (AV:L/PR:L/UI:N); firmware overflow crossing into the host OS justifies S:C with full C:H/I:H/A:H.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
1DescriptionCVE.org
Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
AnalysisAI
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected technology is the 802.11n WLAN stack implemented in Qualcomm Snapdragon chipsets, specifically the code path that handles HT40 channel bonding (two adjacent 20 MHz channels combined into a 40 MHz channel) during Channel Switch Announcement / dynamic channel switching operations. CWE-121 (stack-based buffer overflow) indicates the root cause is a fixed-size stack buffer or structure being written past its bounds when the firmware processes an invalid or attacker-influenced HT40 channel layout descriptor without sufficient length/validity validation. The CPE (cpe:2.3:a:qualcomm,_inc.:snapdragon) is broad and does not enumerate exact SoC models or firmware builds; Qualcomm bulletins typically enumerate the affected chipset list separately. The tags 'Buffer Overflow' and 'Stack Overflow' reinforce the CWE-121 classification.
RemediationAI
Patch available per vendor advisory: apply the fixes published in the Qualcomm July 2026 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html); no single exact fix version is provided in this record, so consult the bulletin's chipset-specific version table and, for end-user devices, install the corresponding OEM Android security patch level that incorporates the Qualcomm fix. As compensating controls until the firmware update propagates, restrict installation of untrusted applications (the local attack vector requires attacker-controlled local code), enforce app vetting/MDM allowlisting on managed fleets, and where operationally acceptable disable 40 MHz (HT40) operation / dynamic channel switching in Wi-Fi configuration to reduce reachability of the vulnerable code path - noting the trade-off of reduced Wi-Fi throughput and DFS flexibility. These mitigations reduce but do not eliminate exposure; the vendor firmware patch is the only complete fix.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to tr
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today