Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Local low-priv trigger (AV:L/PR:L), no UI; disclosure of freed memory across a driver/kernel trust boundary justifies S:C and C:H, with A:L for possible crash and no integrity impact.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
3DescriptionCVE.org
Information Disclosure when a pointer is reused after being deallocated.
AnalysisAI
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access with low privileges (a running low-privileged process/app) on an affected Qualcomm Snapdragon device - no user interaction and no network path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 7.3) describes a locally-exploitable, low-privilege information-disclosure flaw with a scope change and high confidentiality impact - consistent with a low-privileged process reading freed kernel/driver memory that belongs to a higher trust boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: consult the Qualcomm September 2026 security bulletin for per-SoC patches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory the estate against the Qualcomm September 2026 security bulletin to identify which Snapdragon SKUs and software builds we actually operate, and open a tracking record with each device OEM and our mobile device management and Windows-on-Arm procurement contacts to confirm their remediation timelines, since no vendor-released patch exists for CVE-2026-25284 today. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-81331
GHSA-5xpv-76m7-fc52