EUVD-2025-209222Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.
AnalysisAI
Memory corruption via use-after-free in Qualcomm Snapdragon SDK occurs when concurrent fence deregistration and signal handling operations access freed memory, allowing authenticated local attackers with low privileges to achieve information disclosure and integrity/availability compromise. CVSS 6.5 reflects local attack vector with high complexity; no public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
This vulnerability stems from a use-after-free condition (CWE-416) in Qualcomm Snapdragon's memory management subsystem, specifically in the interaction between fence (synchronization primitive) deregistration logic and signal handling routines. The root cause involves improper synchronization or timing of memory deallocation-a fence object is freed while signal handlers or concurrent deregistration code paths still hold references to it. When the freed memory is subsequently accessed, it may contain attacker-controlled or uninitialized data, leading to potential code execution or data corruption. The vulnerability is classified under memory corruption and buffer overflow categories, indicating that the use-after-free may enable writing beyond intended boundaries or executing arbitrary instructions within the same process context.
RemediationAI
Apply the security update provided in Qualcomm's April 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html), which contains the patched Snapdragon SDK version addressing the concurrent fence deregistration issue. If immediate patching is not feasible, restrict local access to Snapdragon SDK components and disable or isolate signal handling routines that interact with fence deregistration where operationally safe. Monitor Qualcomm's advisory for platform-specific patch availability (mobile firmware OTA updates, SoC silicon revisions, SDK point releases) as remediation timelines vary across Snapdragon product tiers.
More in Snapdragon
View allBuffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to tr
Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-afte
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today