EUVD-2025-209231
GHSA-m6mr-p6rr-qvh3
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Tags
Description
Cryptographic issue while copying data to a destination buffer without validating its size.
Analysis
Buffer overread in Qualcomm Snapdragon cryptographic implementation allows authenticated local attackers to expose sensitive memory contents and potentially manipulate cryptographic operations. The vulnerability (CWE-126) stems from copying data to a destination buffer without size validation, creating high confidentiality and integrity risk. EPSS scoring and KEV status not available at time of analysis; no public exploit identified. Affects Qualcomm Snapdragon chipsets with fix documented in April 2026 security bulletin.
Technical Context
This vulnerability represents a CWE-126 buffer overread in Qualcomm's cryptographic subsystem implementation within Snapdragon chipsets. The flaw occurs when cryptographic operations copy data to destination buffers without proper bounds checking, allowing reads beyond allocated memory boundaries. Buffer overreads in cryptographic contexts are particularly severe because they can expose sensitive key material, authentication tokens, or other security-critical data residing in adjacent memory. The CPE identifier (cpe:2.3:a:qualcomm,_inc.:snapdragon) indicates this affects Qualcomm's Snapdragon product line broadly, which powers billions of mobile devices globally. The cryptographic nature suggests this could impact secure boot, trusted execution environments (TEE), encryption/decryption operations, or secure key storage mechanisms within the Snapdragon security architecture.
Affected Products
Qualcomm Snapdragon chipsets are affected per CPE identifier cpe:2.3:a:qualcomm,_inc.:snapdragon. Specific Snapdragon models and firmware versions are not detailed in available data but likely span multiple product generations given Qualcomm's security bulletin scope. This impacts mobile devices, tablets, automotive systems, IoT devices, and other products utilizing Qualcomm Snapdragon system-on-chip platforms. Complete device and version enumeration is available in Qualcomm's April 2026 Security Bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html.
Remediation
Device manufacturers and end users should apply security updates corresponding to Qualcomm's April 2026 Security Bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. Exact patched firmware versions vary by device model and OEM implementation schedule. Enterprise environments should prioritize updating affected Snapdragon-based devices through mobile device management platforms once vendor patches become available. End users should install system updates from device manufacturers (Samsung, Xiaomi, OnePlus, etc.) as they incorporate Qualcomm's fixes into OEM firmware releases. No workarounds are documented; patching is the primary mitigation path. Organizations unable to patch immediately should enforce principle of least privilege for application installations and monitor for anomalous cryptographic operation failures or unexpected privilege escalation attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today