EUVD-2026-19321
GHSA-hfh3-pr7q-frpw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory Corruption when retrieving output buffer with insufficient size validation.
AnalysisAI
Memory corruption in Qualcomm Snapdragon components allows local authenticated attackers to execute arbitrary code with high privileges. A buffer overflow vulnerability (CWE-126) occurs during output buffer retrieval due to insufficient size validation, enabling complete system compromise with high confidentiality, integrity, and availability impact. EPSS risk data not available; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The local attack vector (AV:L) and low complexity (AC:L) make this exploitable by malicious apps or local users on affected Snapdragon-powered devices.
Technical ContextAI
This vulnerability affects Qualcomm Snapdragon system-on-chip (SoC) components, likely within driver or kernel-level code responsible for buffer management. The root cause is classified as CWE-126 (Buffer Over-read), where output buffer operations fail to properly validate size parameters before memory retrieval. Snapdragon SoCs power billions of Android smartphones, tablets, and IoT devices, making their kernel-space and driver-level security critical. The vulnerability occurs when privileged operations retrieve data into undersized buffers, causing memory corruption that can be leveraged for code execution. The CPE designation (cpe:2.3:a:qualcomm,_inc.:snapdragon) indicates broad potential applicability across Qualcomm's Snapdragon product line, though specific affected chipset models require vendor bulletin confirmation.
RemediationAI
Apply firmware updates containing the patches detailed in the Qualcomm April 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html). Device manufacturers (OEMs) must integrate Qualcomm's chipset-level patches into device-specific firmware releases, so end users should check for and install security updates from their device vendor (Samsung, Xiaomi, OnePlus, etc.) that incorporate April 2026 or later Qualcomm patches. For enterprise mobile device management, verify deployed Snapdragon devices receive OEM firmware updates addressing this CVE and enforce update policies. If patches are unavailable for legacy/end-of-life devices, implement defense-in-depth controls: restrict app installation to trusted sources only, disable developer options and ADB debugging, deploy mobile threat defense solutions to detect local privilege escalation attempts, and consider device replacement for high-security environments. No temporary workarounds are available due to the kernel/driver-level nature of the flaw.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today