EUVD-2025-209632Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DSP/kernel path needs an on-device low-priv foothold (AV:L/PR:L); TOCTOU timing window makes it AC:H; successful corruption yields full kernel-level CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
AnalysisAI
Memory corruption in the digital signal processor (DSP) process-creation path on Qualcomm Snapdragon chipsets can be triggered only by a local low-privileged attacker who forces a kernel-level allocation failure and then wins a timing-dependent race condition (CWE-367). This is a local, high-complexity issue (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) affecting many Snapdragon SoCs and platforms, and it can yield high confidentiality, integrity, and availability impact on the target device if the race succeeds. No public exploit was identified at time of analysis, EPSS is 0.01 percent (3rd percentile), and CISA SSVC reports exploitation: none and not automatable; real-world priority is low despite the HIGH base score.
Technical ContextAI
The flaw is a time-of-check/time-of-use (TOCTOU) condition (CWE-367) in the kernel-level creation of a process on Qualcomm's on-chip digital signal processor. The DSP is a separate compute block used for audio, sensor, modem, and other offload workloads; process creation on it requires kernel-mediated allocation, and if that allocation fails under attacker-influenced conditions, a race can corrupt memory. CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* identifies the affected Snapdragon family broadly, while EUVD-2025-209632 enumerates specific Snapdragon mobile, compute, XR, wearable, connectivity, audio, and platform models. Per the authoritative assessment, exploitation requires an existing local foothold (PR:L), no user interaction (UI:N), and a non-deterministic race unlocked by kernel memory-allocation failure; AV:L means no network reachability, AC:H reflects the narrow timing window, and SSVC marks it not automatable.
RemediationAI
Patch available per vendor advisory; exact patched version is not specified in the supplied data. Consult the Qualcomm May 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html and apply the platform-specific OEM or Qualcomm firmware update once the fixed build for the affected Snapdragon model is confirmed. Until that update is applied, reduce exposure by preventing untrusted low-privileged local code from reaching the DSP process-creation interface: restrict debugging and root access, block installation of untrusted applications, enforce SELinux and least-privilege sandboxing, and remove unnecessary local services that can issue DSP process requests. These controls have trade-offs because hardening local execution can disrupt development workflows and diagnostics, while disabling DSP-related services may degrade audio, sensor, or modem-offload features. Monitor for repeated DSP allocation-failure or process-creation errors as a possible exploitation signal, but note that the race is timing-dependent and not remotely triggerable.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today