EUVD-2025-209224
GHSA-34mx-45mg-p6wm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
AnalysisAI
Local privilege escalation in Qualcomm Snapdragon components enables authenticated users to achieve arbitrary code execution with elevated privileges through memory corruption triggered by integer overflow during attestation report generation. The vulnerability requires low attack complexity and low-level authentication (CVSS:3.1/AV:L/AC:L/PR:L), allowing complete compromise of confidentiality, integrity, and availability on affected devices. With CVSS 7.8 (High severity) and local attack vector, this represents a significant risk on multi-user Android devices where malicious apps could exploit the flaw to break out of sandboxing. No public exploit identified at time of analysis, though the buffer overflow class (CWE-120) is well-understood by exploit developers.
Technical ContextAI
This vulnerability affects Qualcomm Snapdragon system-on-chip (SoC) components, specifically within attestation functionality that generates cryptographic reports to verify device integrity and trustworthiness. The root cause is a CWE-120 buffer overflow where an integer overflow during size calculations leads to insufficient buffer allocation before a copy operation. When the copy proceeds with the incorrectly calculated size, it writes beyond allocated memory boundaries, corrupting adjacent memory regions. Attestation report generation typically occurs in trusted execution environments (TEE) or privileged system services, making memory corruption in this context particularly dangerous as it may allow escape from security boundaries. The integer overflow likely occurs when multiplying or adding size parameters without proper bounds checking, a common pattern in buffer management code handling variable-length cryptographic structures.
RemediationAI
Apply firmware security updates provided in the Qualcomm April 2026 Security Bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. Qualcomm typically delivers patches to OEMs and ODMs who must integrate fixes into device-specific firmware builds, meaning end users should monitor their device manufacturer for Android security updates incorporating this patch. For enterprise deployments, prioritize updates for high-value targets like executive devices, kiosks with physical access, and BYOD environments where malicious app installation risk is elevated. Until patches deploy, implement compensating controls including restricting application installation to official app stores with Google Play Protect scanning, enforcing mobile device management policies that limit unknown source installations, and monitoring for privilege escalation attempts through endpoint detection. System administrators should inventory Snapdragon-equipped devices and track patch deployment through MDM platforms, prioritizing devices with high exposure to untrusted applications or physical access by multiple users.
More in Snapdragon
View allBuffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged
Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-
Local memory corruption in Qualcomm Snapdragon platforms (CVE-2025-59604) allows a low-privileged local attacker to trig
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device c
Memory corruption in Qualcomm Snapdragon allows local authenticated attackers with low privileges to achieve arbitrary c
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today