EUVD-2026-52735
GHSA-7wmw-jvfp-wgm7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Cellular MitM via rogue base station demands RF proximity and specialized hardware (AV:A, AC:H); no authentication or user interaction required; impact is confidentiality-only with no integrity or availability consequence.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
AnalysisAI
Qualcomm Snapdragon chipsets fail to verify the consistency of UE security capabilities against those replayed by the network during 3GPP cellular security mode negotiation, enabling a rogue base station operator to force downgraded cryptographic algorithm selection on unpatched devices. The flaw resides in the cellular modem firmware stack and affects all Snapdragon product lines per available CPE data, with no minimum version boundary published. Exploitation yields high confidentiality impact - a sophisticated attacker with radio interception equipment can potentially decrypt cellular communications. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the underlying attack class (security capability bidding-down) is well-documented in cellular security research.
Technical ContextAI
This vulnerability exists within the 3GPP NAS (Non-Access Stratum) security mode command procedure implemented in Qualcomm Snapdragon modem firmware. During cellular connection establishment under LTE and 5G standards, a UE advertises its supported security algorithms (encryption and integrity protection). The network selects algorithms and replays the UE's capabilities back in the Security Mode Command message. A conformant UE must verify that these replayed capabilities match what it originally transmitted - this check is absent or insufficiently enforced in affected Snapdragon firmware. CWE-1294 (Insecure Security Identifier Mechanism) captures the root cause: the identifier (security capability set) used to validate the protocol handshake is not properly integrity-checked against the original UE-sourced value. The CPE string cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* covers all Snapdragon variants with no version constraint, indicating broad chipset family exposure across Snapdragon Mobile, Auto, Compute, and IoT platforms.
RemediationAI
The primary fix is to apply the patched modem firmware delivered through Qualcomm's August 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html). Exact patched firmware or driver versions are not independently confirmed from the provided data - consult the bulletin for per-SKU patch details. Because Snapdragon patches propagate through OEM supply chains, end-users must apply the latest device OS or security update from their device manufacturer (Samsung One UI update, MIUI update, etc.); waiting solely on Qualcomm's bulletin without an OEM patch release does not protect end-user devices. Compensating controls are inherently limited for cellular protocol flaws: users in high-risk environments should adopt end-to-end encrypted communication applications (Signal or equivalent) to mitigate the confidentiality impact of any downgraded radio-layer encryption. Enabling airplane mode in untrusted radio environments reduces exposure but eliminates cellular connectivity. No configuration toggle exists to enforce security capability replay verification without the firmware fix.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today