EUVD-2026-19331Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
AnalysisAI
Local privilege escalation in Qualcomm Snapdragon camera sensor drivers allows authenticated attackers with low privileges to execute arbitrary code with elevated permissions through unchecked output buffer access during IOCTL operations. This out-of-bounds read vulnerability (CWE-126) achieves complete system compromise (confidentiality, integrity, and availability impact all rated High in CVSS). No public exploit identified at time of analysis, though the local attack vector and low complexity suggest proof-of-concept development is feasible for researchers with device access.
Technical ContextAI
This vulnerability affects the camera sensor driver subsystem within Qualcomm Snapdragon chipsets, specifically in the IOCTL (Input/Output Control) handler interface that userspace applications use to communicate with kernel drivers. The root cause is a CWE-126 out-of-bounds read condition where the driver accesses an output buffer during IOCTL processing without first validating the buffer's size boundaries. IOCTL handlers are privileged kernel interfaces that accept user-controlled data structures, making them common targets for local privilege escalation attacks. The memory corruption occurs when the driver reads beyond allocated buffer boundaries, potentially exposing sensitive kernel memory contents or corrupting adjacent memory regions, which can be leveraged to hijack control flow and execute code in kernel context. The affected CPE identifier (cpe:2.3:a:qualcomm,_inc.:snapdragon) indicates broad exposure across Qualcomm's Snapdragon system-on-chip product line, which powers millions of Android mobile devices and embedded systems globally.
RemediationAI
Apply security updates from Qualcomm's April 2026 security bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html, which will specify patched firmware versions and integration guidance for OEMs. End users should install Android security updates from their device manufacturers that incorporate Qualcomm's patches, typically distributed through monthly Android security patch level updates. For enterprise-managed device fleets, prioritize updating devices in high-security contexts or those where malicious app installation risk is elevated. If patches are not immediately available for legacy devices, risk mitigation strategies include restricting camera permission grants to only trusted applications, enforcing device integrity verification (SafetyNet/Play Integrity), and implementing mobile threat defense solutions to detect abnormal IOCTL activity patterns. System administrators should monitor vendor security bulletins from both Qualcomm and device OEMs for confirmation of patch availability in specific product lines.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today