EUVD-2026-33824
GHSA-wfc2-qmjr-85gw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (qualcomm) · only source for this CVE.
CVSS VectorVendor: qualcomm
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Memory corruption while processing multiple IOCTL command for escape operations.
AnalysisAI
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multiple IOCTL commands for escape operations. The flaw, reported by Qualcomm in its June 2026 security bulletin, affects Snapdragon graphics/driver components and can be triggered by a low-privileged local user to achieve high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-787 out-of-bounds write occurring in a kernel-mode driver on Qualcomm Snapdragon platforms when handling IOCTL 'escape' commands - vendor-defined side-channel calls typically used by GPU/display drivers to pass non-standard operations from user space into the kernel driver. Issuing multiple such IOCTL commands in sequence appears to corrupt driver memory, indicating insufficient state validation or bounds checking between calls. The affected CPE is cpe:2.3:a:qualcomm,_inc.:snapdragon, covering the broad Snapdragon SoC software stack typically deployed in Android handsets, automotive, IoT, and Windows-on-Snapdragon devices.
RemediationAI
Patch available per vendor advisory - apply the fixes referenced in the Qualcomm June 2026 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html) once they are integrated by the device OEM, since Snapdragon driver fixes typically reach end users via Android monthly security patch levels or OEM firmware updates rather than directly from Qualcomm. On Android, ensure devices are updated to a security patch level that incorporates the June 2026 Qualcomm fixes; on Windows-on-Snapdragon and embedded platforms, install the corresponding OEM firmware/driver update. As a compensating control until patches arrive, restrict installation of untrusted applications that could invoke the affected driver IOCTLs and, where feasible on managed Android fleets, enforce MDM policies blocking sideloaded apps - noting this does not eliminate risk from any pre-installed app or attacker with shell access.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today