EUVD-2026-52738
GHSA-976j-gf8c-xp87
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV:P confirmed by fastboot's mandatory physical USB requirement; PR:N because fastboot mode requires no credentials; S:C because audio handler memory corruption can propagate into privileged firmware scope.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
AnalysisAI
Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis.
Technical ContextAI
The fastboot protocol is a USB-based interface used to communicate with Android device bootloaders for firmware flashing and device parameter configuration. The affected Qualcomm Snapdragon platform (CPE: cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*) exposes a command handler within fastboot that processes audio framework configuration commands. CWE-1286 (Improper Validation of Syntactic Correctness of Input) indicates the handler fails to correctly validate the syntactic structure of attacker-supplied input, leading to memory corruption - consistent with the 'Buffer Overflow' tag applied to this CVE. When a device is placed in fastboot mode (typically via a hardware key combination at boot), it accepts commands over USB without requiring device-level authentication, which explains the PR:N CVSS metric despite the mandatory physical access requirement. The scope change (S:C) in the vector suggests the corruption can propagate beyond the fastboot execution environment into other privileged components of the Snapdragon platform.
RemediationAI
Apply firmware updates incorporating the Qualcomm-supplied patch as detailed in the August 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html). Patch is available per vendor advisory; however, exact patched firmware version numbers per Snapdragon SKU are not independently confirmed from the provided data and must be verified directly from that bulletin and from downstream OEM advisories for each affected device model. As a meaningful compensating control, organizations managing device fleets should enforce bootloader lock policies via MDM - a locked bootloader rejects unsigned fastboot commands and substantially raises the exploitation bar even if the device is physically compromised, though it does not remediate the underlying memory corruption. OEM downstream firmware release timelines should be tracked separately, as Qualcomm's patch must be integrated and signed by each device manufacturer before distribution to end users.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today