EUVD-2025-209231
GHSA-m6mr-p6rr-qvh3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Cryptographic issue while copying data to a destination buffer without validating its size.
AnalysisAI
Buffer overread in Qualcomm Snapdragon cryptographic implementation allows authenticated local attackers to expose sensitive memory contents and potentially manipulate cryptographic operations. The vulnerability (CWE-126) stems from copying data to a destination buffer without size validation, creating high confidentiality and integrity risk. EPSS scoring and KEV status not available at time of analysis; no public exploit identified. Affects Qualcomm Snapdragon chipsets with fix documented in April 2026 security bulletin.
Technical ContextAI
This vulnerability represents a CWE-126 buffer overread in Qualcomm's cryptographic subsystem implementation within Snapdragon chipsets. The flaw occurs when cryptographic operations copy data to destination buffers without proper bounds checking, allowing reads beyond allocated memory boundaries. Buffer overreads in cryptographic contexts are particularly severe because they can expose sensitive key material, authentication tokens, or other security-critical data residing in adjacent memory. The CPE identifier (cpe:2.3:a:qualcomm,_inc.:snapdragon) indicates this affects Qualcomm's Snapdragon product line broadly, which powers billions of mobile devices globally. The cryptographic nature suggests this could impact secure boot, trusted execution environments (TEE), encryption/decryption operations, or secure key storage mechanisms within the Snapdragon security architecture.
RemediationAI
Device manufacturers and end users should apply security updates corresponding to Qualcomm's April 2026 Security Bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html. Exact patched firmware versions vary by device model and OEM implementation schedule. Enterprise environments should prioritize updating affected Snapdragon-based devices through mobile device management platforms once vendor patches become available. End users should install system updates from device manufacturers (Samsung, Xiaomi, OnePlus, etc.) as they incorporate Qualcomm's fixes into OEM firmware releases. No workarounds are documented; patching is the primary mitigation path. Organizations unable to patch immediately should enforce principle of least privilege for application installations and monitor for anomalous cryptographic operation failures or unexpected privilege escalation attempts.
More in Snapdragon
View allBuffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged
Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-
Local memory corruption in Qualcomm Snapdragon platforms (CVE-2025-59604) allows a low-privileged local attacker to trig
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device c
Memory corruption in Qualcomm Snapdragon allows local authenticated attackers with low privileges to achieve arbitrary c
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today