Skip to main content

Qualcomm Snapdragon CVE-2026-25293

| EUVDEUVD-2026-26992 CRITICAL
Incorrect Authorization (CWE-863)
2026-05-04 qualcomm
9.6
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.6 CRITICAL
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 04, 2026 - 17:48 vuln.today
EUVD ID Assigned
May 04, 2026 - 17:15 euvd
EUVD-2026-26992
Analysis Generated
May 04, 2026 - 17:15 vuln.today
CVE Published
May 04, 2026 - 16:43 nvd
CRITICAL 9.6

DescriptionCVE.org

Buffer overflow due to incorrect authorization in PLC FW

AnalysisAI

Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unauthenticated attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability stems from incorrect authorization logic (CWE-863) that fails to prevent buffer overflow conditions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Join adjacent network (Wi-Fi/Bluetooth)
Delivery
Send crafted packets to PLC firmware
Exploit
Bypass authorization checks
Install
Trigger buffer overflow
C2
Overwrite memory with shellcode
Execute
Execute code at firmware privilege
Impact
Escape sandbox boundaries (scope change)
Step 8
Establish persistence and C2

Vulnerability AssessmentAI

Exploitation Adjacent network access to vulnerable Snapdragon device - attacker must be on same Wi-Fi network, within Bluetooth range, or on same Layer 2 network segment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is HIGH for adjacent network environments but depends heavily on deployment context and network segmentation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Attacker connects to the same Wi-Fi network, Bluetooth proximity, or adjacent subnet as a vulnerable Snapdragon-based device (mobile phone, IoT gateway, automotive head unit). Attacker sends specially crafted packets exploiting the authorization logic flaw to trigger buffer overflow in PLC firmware component. …
Remediation Apply firmware updates specified in the Qualcomm May 2026 Security Bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html, which should detail fixed firmware versions by Snapdragon model and provide OEM update guidance. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all Snapdragon firmware versions in production across mobile devices, IoT endpoints, and edge infrastructure; isolate high-risk Snapdragon devices from adjacent network segments if feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-25277 HIGH
8.8 Jun 01

Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o

CVE-2026-25276 HIGH
8.8 Jun 01

Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr

CVE-2025-47392 HIGH
8.8 Apr 06

Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution

CVE-2026-24088 HIGH
8.2 Jun 01

Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci

CVE-2026-25259 HIGH
7.8 Jun 01

Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip

CVE-2026-25258 HIGH
7.8 Jun 01

Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during

CVE-2025-59606 HIGH
7.8 Jun 01

Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged

CVE-2025-59605 HIGH
7.8 Jun 01

Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-

CVE-2025-59604 HIGH
7.8 Jun 01

Local memory corruption in Qualcomm Snapdragon platforms (CVE-2025-59604) allows a low-privileged local attacker to trig

CVE-2026-24082 HIGH
7.8 May 04

Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device c

CVE-2025-47408 HIGH
7.8 May 04

Memory corruption in Qualcomm Snapdragon allows local authenticated attackers with low privileges to achieve arbitrary c

CVE-2025-47405 HIGH
7.8 May 04

Memory corruption in Qualcomm Snapdragon camera subsystem allows local authenticated users to execute arbitrary code wit

Share

CVE-2026-25293 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy