EUVD-2026-52737
GHSA-668h-p75c-x2rp
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent Wi-Fi range gives AV:A; unauthenticated no-interaction over-the-air parsing bug gives AC:L/PR:N/UI:N; firmware-to-host compromise justifies S:C with full C/I/A impact.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
AnalysisAI
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.
Technical ContextAI
NAN (Neighbor Awareness Networking, marketed as Wi-Fi Aware) is a Wi-Fi peer-discovery protocol implemented in the Snapdragon wireless/connectivity firmware. Service Discovery Frames advertise capabilities via structured attributes, including the Device Capability Extended attribute. The flaw is a classic CWE-121 stack-based buffer overflow: a declared length field in the attribute is not validated against the actual buffer, so parsing an attribute with an invalid (oversized/malformed) length writes past a fixed stack buffer. The single CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* identifies affected components broadly across Snapdragon platforms rather than a precise chip/firmware version list.
RemediationAI
Patch available per vendor advisory: apply the fixes referenced in Qualcomm's August 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html) as delivered through OEM/carrier firmware and Android security updates; no exact standalone fix version is provided in the input, so track the specific patched firmware level published by your device vendor. As a compensating control until patched, disable Wi-Fi Aware/NAN if the device or MDM exposes that setting, or disable Wi-Fi in untrusted RF environments - the trade-off is loss of peer-to-peer discovery features and general Wi-Fi connectivity. Reducing exposure to untrusted wireless proximity (avoiding crowded public spaces with Wi-Fi on) lowers practical risk given the adjacent-network attack vector.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attac
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today