EUVD-2025-210027
GHSA-f9gj-4jh7-cm39
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Memory Corruption when sending random number generator command with insufficient output buffer size.
AnalysisAI
Memory corruption in Qualcomm Snapdragon platforms allows a locally privileged attacker to trigger an out-of-bounds write by issuing a random number generator (RNG) command paired with an undersized output buffer, yielding complete confidentiality, integrity, and availability impact. The vulnerability requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H), placing the base score at 6.7 (Medium) despite the high C/I/A ratings. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-787 (Out-of-Bounds Write) is the root cause: when a caller issues an RNG command to the Snapdragon subsystem and provides an output buffer smaller than the data the command attempts to write, no bounds check is enforced, resulting in writes beyond the allocated buffer boundary. This class of defect commonly arises in firmware or trusted execution environment (TEE) interfaces where command dispatch handlers trust caller-supplied buffer sizes without validation. The affected component is the Qualcomm Snapdragon platform family (CPE: cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*), which spans a broad range of mobile and IoT SoCs. The wildcard CPE version field indicates Qualcomm has not publicly scoped the vulnerability to a discrete version range in available intelligence.
RemediationAI
Apply the update referenced in the Qualcomm June 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html). An exact patched firmware or software version is not confirmed in the available source data - patch availability is confirmed per vendor advisory, but the specific fix version should be verified against the bulletin and OEM downstream releases. Qualcomm patches typically reach end users through OEM device firmware updates (e.g., Android security patches), so device owners should apply the next available OEM system update incorporating the June 2026 Qualcomm security content. As a compensating control where patching is delayed, restrict access to privileged interfaces that invoke RNG commands - specifically limit which processes or users can invoke Snapdragon TEE or kernel-level RNG APIs. Note that this mitigation may impact applications relying on hardware-backed random number generation.
More in Snapdragon
View allBuffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multip
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged
Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-
Local memory corruption in Qualcomm Snapdragon platforms (CVE-2025-59604) allows a low-privileged local attacker to trig
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device c
Memory corruption in Qualcomm Snapdragon allows local authenticated attackers with low privileges to achieve arbitrary c
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today