EUVD-2026-41933
GHSA-hmx9-2rg5-jc4p
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
TOCTOU race needs local low-privileged code (AV:L/PR:L) and reliable race-win (AC:H); successful memory corruption yields full compromise (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (qualcomm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.
AnalysisAI
Local privilege escalation via memory corruption in Qualcomm Snapdragon platforms occurs when asynchronous input parameters are validated and then re-read after modification, a time-of-check/time-of-use race that yields total compromise of confidentiality, integrity, and availability. Affecting a broad range of Snapdragon connectivity, WCD codec, WSA, and compute SoCs, a local low-privileged attacker who can win the race can corrupt memory and gain elevated code execution. No public exploit has been identified at time of analysis and EPSS is negligible (0.09%), but the CVSS 7.0 and 'total' SSVC technical impact make it a meaningful firmware/driver patch target.
Technical ContextAI
The root cause is CWE-367 (Time-of-Check Time-of-Use race condition): a parameter is checked for validity, but between that check and its subsequent use the value is modified - here explicitly described as asynchronous input parameters whose values change between check and use. In practice on Snapdragon this pattern arises when kernel-mode drivers, TrustZone, or firmware copy shared/user-controlled buffer parameters (e.g., from userspace or a peripheral) and re-fetch them rather than using a validated cached copy, allowing a double-fetch that bypasses bounds validation and corrupts memory. The vendor tags this as a Buffer Overflow, consistent with the modified length/pointer being used after validation. Affected CPEs are Qualcomm Snapdragon SoCs and connectivity/codec components (cpe:2.3:a:qualcomm,_inc.:snapdragon), spanning FastConnect Wi-Fi/BT chips (6900, 7800), WCD audio codecs (WCD9378C/9380/9385), WSA speaker amplifiers (WSA8840/8845/8845H), and compute/SoC parts (SC8380XP), indicating a shared code component reused across many product lines.
RemediationAI
Patch available per vendor advisory: apply the firmware/driver updates published in the Qualcomm July 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html) as delivered through your device OEM's software/OTA update for the affected Snapdragon component; the provided data does not enumerate exact fixed build numbers, so map your specific SoC/codec part to the bulletin's per-component fix. No exact patched version string is independently confirmed in the input, so do not assume a version - obtain it from the OEM. Because this is a local, high-complexity TOCTOU flaw, compensating controls until patching center on limiting local code execution: restrict installation of untrusted third-party applications and enforce app sandboxing/SELinux enforcing mode to reduce which low-privileged processes can reach the vulnerable driver interface (trade-off: may block legitimately sideloaded apps); limit physical/console access to high-value devices (trade-off: operational friction for field devices); and monitor for repeated rapid ioctl/parameter submissions indicative of race exploitation attempts (trade-off: potential false positives, no true prevention). These reduce but do not eliminate exposure - patching is the only complete fix.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today