EUVD-2026-33827
GHSA-gffw-46h4-vh42
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (qualcomm) · only source for this CVE.
CVSS VectorVendor: qualcomm
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Memory corruption while using Strongbox due to buffer overflow.
AnalysisAI
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer overflow that crosses a security boundary (scope changed) and compromises confidentiality, integrity, and availability of the device. The flaw is reported directly by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 8.8 with no public exploit identified at time of analysis. Strongbox is the hardware-backed keystore used to protect cryptographic material, so successful exploitation undermines a core trust component of Snapdragon-based mobile platforms.
Technical ContextAI
Strongbox is Android's hardware-backed Keymaster/Keystore implementation that on Qualcomm platforms is typically realized inside a Trusted Execution Environment (TEE) such as Qualcomm's QSEE/QTEE, isolated from the Rich Execution Environment (REE) running Android. The defect is CWE-120 (Classic Buffer Overflow): code performs a copy into a fixed-size buffer without correctly bounding the input length, allowing adjacent memory to be corrupted. Because the CVSS vector reports Scope:Changed, the corruption occurs in privileged/trusted code paths exposed to a lower-privileged caller, meaning an Android-context process talking to Strongbox can corrupt memory inside a more trusted security domain. The affected component is identified by CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* - all Snapdragon SoCs whose Strongbox firmware has not received the June 2026 fix.
RemediationAI
Apply the Qualcomm-released patch by updating to the June 2026 (or later) Android security patch level once the device OEM publishes a firmware image that includes the fixed Strongbox/trusted-application code, per the vendor advisory at https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html. Patch status: Patch available per vendor advisory; exact fixed Strongbox TA version is not enumerated in the input data and must be confirmed against the bulletin or OEM release notes. Because the vulnerability sits in TEE firmware delivered by the SoC vendor through OEM updates, there is no end-user-applicable workaround that closes the bug itself; meaningful compensating controls until the patch arrives are restricting installation to vetted apps via Play Protect / MDM allowlisting (reduces the pool of local attackers that could reach the Keymaster HAL but does not stop a malicious privileged process), disabling biometric/Strongbox-backed unlock for high-value accounts so that key compromise is less catastrophic (trade-off: degraded UX and weaker key protection), and on managed fleets blocking devices running pre-June-2026 patch levels from accessing sensitive enterprise resources via attestation-based conditional access (trade-off: user lockout until OEMs ship the update).
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to tr
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today