Snapdragon
Monthly
Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.
Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.
A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.
Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.
Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local memory corruption in Qualcomm Snapdragon-based devices can be triggered by a low-privileged local attacker supplying a crafted large data buffer that overflows an additive length check. Successful exploitation grants high confidentiality, integrity, and availability impact within the affected component, matching a local privilege-escalation profile rather than a remote attack primitive. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not specify the vulnerable subsystem or exact chipset models.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.
Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Denial of service in Qualcomm Snapdragon-based devices allows adjacent-network attackers to cause a transient, recoverable outage by sending large or numerous request buffers to a subsystem that fails to validate memory allocation. The vulnerability requires no authentication or user interaction but demands proximity within radio/link-layer range (CVSS 3.1 score 7.4, AV:A/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the impact is limited to availability; data confidentiality and integrity remain unaffected.
Local privilege escalation in Qualcomm Snapdragon platforms can occur when a low-privileged local process supplies an insufficiently sized user buffer to an escape handling driver flow, producing an out-of-bounds write (CWE-787). The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so an attacker who already has a foothold on the device as a low-privileged user could corrupt memory and potentially achieve code execution or elevation; authentication requirements are local low privileges per the vector, and no user interaction is required. No public exploit identified at time of analysis, and the assessed risk is a genuine local privilege-escalation issue that is not a drop-everything emergency; Qualcomm's September 2026 security bulletin is the primary advisory, though exact affected chipsets and patched versions are not enumerated in the provided data.
Memory corruption in Qualcomm Snapdragon I2C transfer request handling can allow a local low-privileged attacker to corrupt memory and potentially achieve privilege escalation or impact confidentiality, integrity, and availability by winning a race condition between memory allocation and data copying. The assessed risk is local-only and high-complexity because exploitation requires code execution on the device and repeated concurrent requests to hit the timing window, and no public exploit identified at time of analysis. Affected platforms are Qualcomm Snapdragon chipsets, with the vendor's September 2026 security bulletin providing the authoritative mapping and remediation guidance.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.
Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.
Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.
Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis.
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.
Transient denial of service in Qualcomm Snapdragon's Wi-Fi 6 stack allows adjacent, unauthenticated attackers to crash affected devices by transmitting a malformed Target Wake Time (TWT) channel usage response frame with an undersized packet payload. The CVSS scope change (S:C) indicates the crash propagates beyond the Wi-Fi subsystem to impact the broader host environment. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Qualcomm Snapdragon chipsets fail to verify the consistency of UE security capabilities against those replayed by the network during 3GPP cellular security mode negotiation, enabling a rogue base station operator to force downgraded cryptographic algorithm selection on unpatched devices. The flaw resides in the cellular modem firmware stack and affects all Snapdragon product lines per available CPE data, with no minimum version boundary published. Exploitation yields high confidentiality impact - a sophisticated attacker with radio interception equipment can potentially decrypt cellular communications. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the underlying attack class (security capability bidding-down) is well-documented in cellular security research.
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.
Local privilege escalation via memory corruption in Qualcomm Snapdragon platforms occurs when asynchronous input parameters are validated and then re-read after modification, a time-of-check/time-of-use race that yields total compromise of confidentiality, integrity, and availability. Affecting a broad range of Snapdragon connectivity, WCD codec, WSA, and compute SoCs, a local low-privileged attacker who can win the race can corrupt memory and gain elevated code execution. No public exploit has been identified at time of analysis and EPSS is negligible (0.09%), but the CVSS 7.0 and 'total' SSVC technical impact make it a meaningful firmware/driver patch target.
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive key material can be exposed in Qualcomm Snapdragon platforms because AES-GCM key wrapping is performed with a hardcoded/static initialization vector instead of a unique per-call nonce. A local, low-privileged attacker who can collect multiple wrapped outputs can exploit the resulting IV/nonce reuse to recover confidentiality and forge integrity of wrapped keys. There is no public exploit identified at time of analysis, and the issue is disclosed via Qualcomm's July 2026 security bulletin.
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with sizes exceeding the maximum allowed value corrupts adjacent memory (CWE-126, buffer over-read/overflow). A local attacker with low privileges (PR:L) and no user interaction can compromise confidentiality, integrity, and availability (all High), scoring CVSS 7.8. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer overflow that crosses a security boundary (scope changed) and compromises confidentiality, integrity, and availability of the device. The flaw is reported directly by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 8.8 with no public exploit identified at time of analysis. Strongbox is the hardware-backed keystore used to protect cryptographic material, so successful exploitation undermines a core trust component of Snapdragon-based mobile platforms.
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox trusted execution component, where a missing bounds check enables memory corruption from a low-privileged context. A successful exploit crosses a trust boundary (CVSS scope=Changed) and yields high impact to confidentiality, integrity, and availability on the affected device. No public exploit identified at time of analysis, and EPSS data was not provided alongside this advisory.
Local privilege escalation via memory corruption in Qualcomm Snapdragon chipsets arises from a time-of-check-to-time-of-use (TOCTOU) race condition where a shared buffer is read after a validation check while a concurrent user-mode thread modifies the underlying input. A local application holding low privileges can win the race window to corrupt kernel or firmware memory, achieving total loss of confidentiality, integrity, and availability on affected Snapdragon SoCs. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 3rd percentile), indicating no observed exploitation activity.
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multiple IOCTL commands for escape operations. The flaw, reported by Qualcomm in its June 2026 security bulletin, affects Snapdragon graphics/driver components and can be triggered by a low-privileged local user to achieve high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during IOCTL escape operation processing, resulting in memory corruption. A local authenticated attacker with low privileges on an affected Snapdragon-based device can leverage the flaw to achieve high-impact compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon fastboot bootloader when processing commands that set the display mode allows a high-privileged local attacker with physical device access to corrupt memory and potentially execute code outside the bootloader's security context. The flaw, reported by Qualcomm and disclosed in their June 2026 security bulletin, affects Snapdragon platforms across the product line per the supplied CPE. No public exploit has been identified at the time of analysis, and the CVSS 7.2 score reflects the high privilege and physical access barriers that limit broad exploitation.
Memory corruption in Qualcomm Snapdragon fastboot bootloader processing allows a physically present attacker with high privileges to corrupt memory by submitting improperly formatted fastboot commands. The flaw carries a CVSS 7.2 score reflecting physical attack vector with scope change, and no public exploit identified at time of analysis. Disclosed in Qualcomm's June 2026 security bulletin, it affects Snapdragon platforms exposed during device provisioning, recovery, or firmware-flash workflows.
Boot flow tampering in Qualcomm Snapdragon platforms allows a local authenticated attacker to bypass cryptographic verification of partition table entries and modify the device's boot process, achieving high impact to confidentiality and integrity. Qualcomm disclosed the issue in its June 2026 security bulletin, classifying it as an authentication bypass affecting Snapdragon products. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the boot-chain location of the flaw makes it strategically valuable for persistent compromise.
Memory corruption in Qualcomm Snapdragon fastboot bootloader handling allows a privileged local attacker with physical access to corrupt memory by issuing malformed fastboot commands, with scope change (CVSS S:C) indicating impact extends beyond the bootloader's security boundary. The flaw was disclosed by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 7.2 (High). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a specific partition and load a customized (unsigned or tampered) bootloader, breaking the device's chain of trust. The flaw, reported by Qualcomm itself in its June 2026 security bulletin, carries a CVSS of 8.2 with scope change due to its impact on trusted firmware boundaries, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon fastboot OEM command handling allows a local attacker with high privileges and physical access to compromise device confidentiality, integrity, and availability. The CVSS 7.2 score reflects the physical attack vector (AV:P) offset by high impact and scope change, and no public exploit identified at time of analysis. Disclosure originates from Qualcomm's June 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon platforms stems from a stack-based memory corruption triggered while processing display command line information with an uninitialized variable. With CVSS 7.2 and a physical attack vector requiring high privileges, the flaw allows a privileged local attacker to corrupt memory and impact confidentiality, integrity, and availability across a changed security scope. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unauthenticated attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability stems from incorrect authorization logic (CWE-863) that fails to prevent buffer overflow conditions. CVSS score of 9.6 reflects adjacent network attack vector with low complexity and no required privileges or user interaction, with scope change indicating container/hypervisor escape or lateral movement potential. No CISA KEV listing or public exploit identified at time of analysis, though EPSS data not available to assess exploitation probability.
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device compromise. Low-privilege authenticated users can trigger memory corruption during performance counter deselect operations, gaining high-integrity code execution with kernel-level access. Qualcomm has released patches in their May 2026 security bulletin. EPSS data not yet available for this future-dated CVE; no confirmed active exploitation or public exploit code identified at time of analysis.
Memory corruption in Qualcomm Snapdragon components allows local authenticated users to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability through malformed power management requests. The vulnerability stems from improper validation of input/output buffer sizes in power management handlers. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV) or public exploit code identified at time of analysis. Qualcomm addressed this in their April 2026 security bulletin.
Buffer over-read (CWE-126) in Qualcomm Snapdragon devices causes denial-of-service when processing malformed Neighborhood Awareness Networking (NAN) service data frames with excessive length values. Attack requires network proximity, high attacker privileges, user interaction, and high complexity (CVSS 7.6), yielding CVSS scope change with potential high confidentiality/integrity impact beyond availability disruption. Qualcomm April 2026 bulletin addresses this transient DOS condition. No public exploit identified at time of analysis, though the specific protocol implementation flaw in NAN device discovery presents measurable risk in adjacent network scenarios where attackers have elevated Wi-Fi protocol access.
Local privilege escalation via use-after-free in Qualcomm Snapdragon video memory management allows authenticated attackers with low privileges to achieve complete system compromise. The vulnerability exists in deprecated DMABUF IOCTL interfaces used for direct memory access buffer operations. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026 CVE. Qualcomm addressed this in their April 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon camera sensor drivers allows authenticated users to execute arbitrary code with elevated privileges through memory corruption. The vulnerability stems from unbounded buffer access during IOCTL processing, enabling attackers to corrupt memory and achieve complete system compromise (confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis. Affects Qualcomm Snapdragon-powered devices across mobile and IoT ecosystems.
Local privilege escalation in Qualcomm Snapdragon camera sensor drivers allows authenticated attackers with low privileges to execute arbitrary code with elevated permissions through unchecked output buffer access during IOCTL operations. This out-of-bounds read vulnerability (CWE-126) achieves complete system compromise (confidentiality, integrity, and availability impact all rated High in CVSS). No public exploit identified at time of analysis, though the local attack vector and low complexity suggest proof-of-concept development is feasible for researchers with device access.
Memory corruption in Qualcomm Snapdragon chipsets allows authenticated local attackers with low privileges to execute arbitrary code, elevate privileges, or cause system crashes through improper IOCTL buffer validation. The vulnerability achieves complete compromise of confidentiality, integrity, and availability (CVSS 7.8 HIGH). No public exploit code identified at time of analysis, though exploitation requires only low attack complexity once local access is obtained. Qualcomm addressed this in their April 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon auxiliary sensor I/O control processing allows authenticated local attackers to achieve arbitrary code execution with high integrity and confidentiality impact. The vulnerability stems from insufficient buffer size validation (CWE-126: Buffer Over-read) when handling sensor control commands. With CVSS 7.8 and local attack vector requiring low privileges, this represents a moderate real-world risk for privilege escalation attacks on Android and IoT devices using affected Snapdragon chipsets. No public exploit code or CISA KEV listing identified at time of analysis, though the April 2026 bulletin date suggests recent disclosure.
Local privilege escalation in Qualcomm Snapdragon products allows authenticated attackers to gain kernel-level code execution through memory corruption during IOCTL processing. The vulnerability stems from unchecked buffer size validation when writing to output buffers, enabling high-impact compromise of confidentiality, integrity, and availability on affected mobile and embedded devices. With a CVSS score of 7.8 and low attack complexity (AC:L), this represents a significant privilege escalation vector for malicious applications or local users, though no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon components allows authenticated local attackers to corrupt kernel memory through malformed IOCTL requests. Exploitation requires low-privilege local access but no user interaction (CVSS 7.8, AV:L/PR:L). The vulnerability enables attackers to achieve high impact across confidentiality, integrity, and availability through unsafe memcpy operations that fail to validate buffer sizes. No public exploit identified at time of analysis, though the straightforward attack complexity (AC:L) suggests exploitation development is feasible for adversaries with local access.
Memory corruption in Qualcomm Snapdragon components allows local authenticated attackers to execute arbitrary code with high privileges. A buffer overflow vulnerability (CWE-126) occurs during output buffer retrieval due to insufficient size validation, enabling complete system compromise with high confidentiality, integrity, and availability impact. EPSS risk data not available; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The local attack vector (AV:L) and low complexity (AC:L) make this exploitable by malicious apps or local users on affected Snapdragon-powered devices.
Out-of-bounds read in Qualcomm Snapdragon WiFi firmware triggers denial-of-service when processing malformed FILS Discovery frames during network scans. Remote attackers on the same wireless network can crash affected devices by broadcasting specially crafted 802.11ai Fast Initial Link Setup frames with invalid action field sizes. CVSS 7.6 (High) reflects the high attack complexity and required high privileges, though the confidentiality/integrity impacts appear overstated for a transient DOS condition. EPSS data not available; no public exploit identified at time of analysis.
A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.
Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.
Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.
Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chipsets lets an attacker who has physical possession of a device feed a crafted ELF file during the early boot sequence and corrupt bootloader memory, with the scope change indicating a possible escape from the normal boot context into the secure/TrustZone world. Exploitation is highly constrained: CVSS 3.1 scores it 6.9 under a vector of AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning physical access, low-level privileges, high attack complexity (specific timing or hardware state) and user interaction are all required; the practical exposure is limited to lost or stolen devices, supply-chain interdiction, or forensic scenarios rather than remote or default network-reachable attacks. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); Qualcomm has published a security bulletin (May 2026) covering the issue.
Memory corruption in Qualcomm Snapdragon platforms allows an attacker who already holds a low-privileged local foothold on the device to corrupt memory by feeding oversized input into a copy routine that exceeds expected allocation limits, giving high impact to confidentiality, integrity, and availability of the affected component. The flaw is not remotely exploitable on its own: exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) - for example a malicious or compromised application able to reach the vulnerable code path - and no user interaction is needed. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided; the referenced Qualcomm September 2026 security bulletin is the authoritative source for the specific affected chipsets and fixed versions.
Information disclosure in Qualcomm Snapdragon chipsets exposes private data transmitted during NG-eCall SIP signaling when IPSec negotiation fails or is improperly established. Attackers adjacent to the network can intercept unprotected signaling traffic, gaining access to sensitive session data - potentially including location coordinates and caller identity transmitted as part of the automated emergency call system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Information disclosure in Qualcomm Snapdragon wireless subsystem allows an adjacent-network attacker to leak sensitive memory contents by transmitting malformed wireless channel switch frames with invalid length fields. The root cause is CWE-191 (integer underflow), where improperly formatted length values trigger an arithmetic wrap condition during 802.11 management frame parsing, resulting in out-of-bounds memory reads. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the low attack complexity and no-authentication requirement on an adjacent wireless segment represent a meaningful real-world risk for shared wireless environments.
Memory corruption in Qualcomm Snapdragon's registry value processing exposes devices to potential code execution by high-privileged local attackers. The flaw, rooted in CWE-120 (classic buffer overflow), is triggered when a direct query method processes registry values supplied with incorrect types - bypassing proper type-length validation and corrupting adjacent memory. While the full C:H/I:H/A:H impact triad indicates serious consequences if reached, the PR:H (high privilege) and AV:L (local) CVSS metrics substantially narrow the realistic attack surface. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Qualcomm Snapdragon firmware triggers an out-of-bounds write (CWE-787) when prepared commands are updated using invalid port indices supplied from user space that exceed supported read client limits. The vulnerability spans an exceptionally broad portfolio of Snapdragon chipsets covering mobile, automotive, XR/AR, and connectivity platforms. No public exploit has been identified at time of analysis, and CISA SSVC assessment rates exploitation as none and the flaw as non-automatable, though the changed scope (S:C) in the CVSS vector indicates impact can propagate beyond the directly vulnerable firmware component.
Memory corruption in Qualcomm Snapdragon silicon allows a local low-privileged attacker to trigger an out-of-bounds write (CWE-787) by submitting input with a buffer plane count or batch size exceeding the maximum allowed value. The scope change in the CVSS vector (S:C) indicates the corruption can escape the vulnerable component's security boundary, yielding partial confidentiality, integrity, and availability impact on an adjacent system component. No public exploit or active exploitation has been identified at time of analysis; SSVC confirms no known exploitation and non-automatable attack conditions.
Out-of-bounds write in Qualcomm Snapdragon's flash command handler allows a local low-privileged attacker to corrupt memory by exploiting a race condition between userspace LED count modifications and kernel-side flash command processing. The CVSS scope change (S:C) indicates the corruption can reach components beyond the immediately vulnerable driver - raising the potential for privilege escalation on affected Snapdragon-based devices. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in Qualcomm Snapdragon's JPEG command parser exposes local low-privilege users to memory corruption via crafted JPEG input. Validation checks within the parser fail to account for extra buffer writes, overwriting adjacent memory and enabling a scope change beyond the vulnerable component's boundary - consistent with Snapdragon's isolated subsystem architecture (DSP, camera ISP). Qualcomm disclosed this in its July 2026 Security Bulletin; no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in Qualcomm Snapdragon chipset drivers allows a malicious application to trigger a use-after-free by issuing multiple IOCTL calls that reference the same buffer file descriptor. The flaw affects a broad range of Snapdragon mobile, compute, connectivity (FastConnect/WCN/WCD/WSA) and XR platforms, and successful exploitation can corrupt kernel memory to gain high impact on confidentiality, integrity and availability. There is no public exploit identified at time of analysis, EPSS risk is very low (0.09%), and CISA SSVC rates exploitation as none.
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to trigger access of already-freed memory by issuing multiple IOCTL calls that reference the same buffer file descriptor. A successful attacker gains full compromise of confidentiality, integrity, and availability on the affected device, which in practice can mean kernel-level code execution or privilege escalation from an unprivileged app. There is no public exploit identified at time of analysis, EPSS is negligible (0.09%, 1st percentile), and CISA SSVC records no known exploitation.
Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-after-free condition in the device driver's input/output control (ioctl) path for mapping and unmapping persistent memory buffers can be triggered by an authenticated local application. Improper synchronization on these operations lets a low-privileged process corrupt kernel memory to gain full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.09%), consistent with CISA SSVC scoring exploitation as none.
Memory corruption in Qualcomm Snapdragon platforms allows a locally privileged attacker to trigger an out-of-bounds write by issuing a random number generator (RNG) command paired with an undersized output buffer, yielding complete confidentiality, integrity, and availability impact. The vulnerability requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H), placing the base score at 6.7 (Medium) despite the high C/I/A ratings. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack-based buffer overflow in Qualcomm Snapdragon corrupts memory during a data copy operation when the output buffer is sized smaller than the input buffer, enabling a high-privileged local attacker to achieve full compromise of confidentiality, integrity, and availability on affected devices. Rooted in CWE-121, this vulnerability can allow control-flow hijacking via stack memory overwrite on Snapdragon-based platforms. No public exploit identified at time of analysis and no CISA KEV listing, but the high-impact triad (C:H/I:H/A:H) warrants prompt patching in environments where privileged access is shared or contested.
Stack-based buffer overflow in Qualcomm Snapdragon Windows drivers allows a locally authenticated high-privilege attacker to cause memory corruption by sending a malformed trusted application request. The vulnerability affects Snapdragon-based systems running Windows drivers and can result in complete compromise of confidentiality, integrity, and availability. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Memory corruption via out-of-bounds write in Qualcomm Snapdragon diagnostic services allows a local, highly-privileged attacker to achieve high-impact compromise of confidentiality, integrity, and availability. The root cause is absent input validation in the diagnostic services component, enabling a crafted payload to corrupt memory. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon affects the IOCTL request processing path, exploitable by a local attacker with high privileges who can win a race condition between API version validation and user-space buffer consumption. Successful exploitation yields high-impact confidentiality, integrity, and availability compromise despite the moderate overall CVSS score of 6.4, which is suppressed by the high attack complexity and privilege requirements. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate widespread risk.
Qualcomm Snapdragon chipsets improperly parse 802.11 advertisement frames containing malformed MBSSID (Multiple BSSID) elements of insufficient length, triggering a buffer over-read that discloses memory contents to an attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C) indicates network-reachable exploitation with changed scope, meaning the impact crosses beyond the Wi-Fi subsystem into adjacent components. No public exploit identified at time of analysis, and no CISA KEV listing exists; Qualcomm addressed this in their June 2026 Security Bulletin.
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged local access to corrupt memory during secure data initialization, leading to high impact on confidentiality, integrity, and availability. The flaw is traceable to a NULL pointer dereference (CWE-476) reachable when heap memory is exhausted, and is addressed in the Qualcomm June 2026 security bulletin. No public exploit identified at time of analysis, and EPSS data was not provided.
Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-privileged local attacker to corrupt memory by supplying device identifier strings exceeding the expected maximum length. The CVSS 7.8 (AV:L/AC:L/PR:L) profile combined with CWE-787 out-of-bounds write indicates a classic stack/heap overflow path that can be leveraged for code execution with full confidentiality, integrity, and availability impact on affected devices. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.
Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.
A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.
Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.
Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local memory corruption in Qualcomm Snapdragon-based devices can be triggered by a low-privileged local attacker supplying a crafted large data buffer that overflows an additive length check. Successful exploitation grants high confidentiality, integrity, and availability impact within the affected component, matching a local privilege-escalation profile rather than a remote attack primitive. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not specify the vulnerable subsystem or exact chipset models.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.
Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Denial of service in Qualcomm Snapdragon-based devices allows adjacent-network attackers to cause a transient, recoverable outage by sending large or numerous request buffers to a subsystem that fails to validate memory allocation. The vulnerability requires no authentication or user interaction but demands proximity within radio/link-layer range (CVSS 3.1 score 7.4, AV:A/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the impact is limited to availability; data confidentiality and integrity remain unaffected.
Local privilege escalation in Qualcomm Snapdragon platforms can occur when a low-privileged local process supplies an insufficiently sized user buffer to an escape handling driver flow, producing an out-of-bounds write (CWE-787). The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so an attacker who already has a foothold on the device as a low-privileged user could corrupt memory and potentially achieve code execution or elevation; authentication requirements are local low privileges per the vector, and no user interaction is required. No public exploit identified at time of analysis, and the assessed risk is a genuine local privilege-escalation issue that is not a drop-everything emergency; Qualcomm's September 2026 security bulletin is the primary advisory, though exact affected chipsets and patched versions are not enumerated in the provided data.
Memory corruption in Qualcomm Snapdragon I2C transfer request handling can allow a local low-privileged attacker to corrupt memory and potentially achieve privilege escalation or impact confidentiality, integrity, and availability by winning a race condition between memory allocation and data copying. The assessed risk is local-only and high-complexity because exploitation requires code execution on the device and repeated concurrent requests to hit the timing window, and no public exploit identified at time of analysis. Affected platforms are Qualcomm Snapdragon chipsets, with the vendor's September 2026 security bulletin providing the authoritative mapping and remediation guidance.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.
Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.
Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.
Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis.
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.
Transient denial of service in Qualcomm Snapdragon's Wi-Fi 6 stack allows adjacent, unauthenticated attackers to crash affected devices by transmitting a malformed Target Wake Time (TWT) channel usage response frame with an undersized packet payload. The CVSS scope change (S:C) indicates the crash propagates beyond the Wi-Fi subsystem to impact the broader host environment. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Qualcomm Snapdragon chipsets fail to verify the consistency of UE security capabilities against those replayed by the network during 3GPP cellular security mode negotiation, enabling a rogue base station operator to force downgraded cryptographic algorithm selection on unpatched devices. The flaw resides in the cellular modem firmware stack and affects all Snapdragon product lines per available CPE data, with no minimum version boundary published. Exploitation yields high confidentiality impact - a sophisticated attacker with radio interception equipment can potentially decrypt cellular communications. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the underlying attack class (security capability bidding-down) is well-documented in cellular security research.
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.
Local privilege escalation via memory corruption in Qualcomm Snapdragon platforms occurs when asynchronous input parameters are validated and then re-read after modification, a time-of-check/time-of-use race that yields total compromise of confidentiality, integrity, and availability. Affecting a broad range of Snapdragon connectivity, WCD codec, WSA, and compute SoCs, a local low-privileged attacker who can win the race can corrupt memory and gain elevated code execution. No public exploit has been identified at time of analysis and EPSS is negligible (0.09%), but the CVSS 7.0 and 'total' SSVC technical impact make it a meaningful firmware/driver patch target.
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive key material can be exposed in Qualcomm Snapdragon platforms because AES-GCM key wrapping is performed with a hardcoded/static initialization vector instead of a unique per-call nonce. A local, low-privileged attacker who can collect multiple wrapped outputs can exploit the resulting IV/nonce reuse to recover confidentiality and forge integrity of wrapped keys. There is no public exploit identified at time of analysis, and the issue is disclosed via Qualcomm's July 2026 security bulletin.
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with sizes exceeding the maximum allowed value corrupts adjacent memory (CWE-126, buffer over-read/overflow). A local attacker with low privileges (PR:L) and no user interaction can compromise confidentiality, integrity, and availability (all High), scoring CVSS 7.8. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer overflow that crosses a security boundary (scope changed) and compromises confidentiality, integrity, and availability of the device. The flaw is reported directly by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 8.8 with no public exploit identified at time of analysis. Strongbox is the hardware-backed keystore used to protect cryptographic material, so successful exploitation undermines a core trust component of Snapdragon-based mobile platforms.
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox trusted execution component, where a missing bounds check enables memory corruption from a low-privileged context. A successful exploit crosses a trust boundary (CVSS scope=Changed) and yields high impact to confidentiality, integrity, and availability on the affected device. No public exploit identified at time of analysis, and EPSS data was not provided alongside this advisory.
Local privilege escalation via memory corruption in Qualcomm Snapdragon chipsets arises from a time-of-check-to-time-of-use (TOCTOU) race condition where a shared buffer is read after a validation check while a concurrent user-mode thread modifies the underlying input. A local application holding low privileges can win the race window to corrupt kernel or firmware memory, achieving total loss of confidentiality, integrity, and availability on affected Snapdragon SoCs. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 3rd percentile), indicating no observed exploitation activity.
Local privilege escalation in Qualcomm Snapdragon platforms is possible through memory corruption when processing multiple IOCTL commands for escape operations. The flaw, reported by Qualcomm in its June 2026 security bulletin, affects Snapdragon graphics/driver components and can be triggered by a low-privileged local user to achieve high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Qualcomm Snapdragon platforms stems from an out-of-bounds read (CWE-125) triggered during IOCTL escape operation processing, resulting in memory corruption. A local authenticated attacker with low privileges on an affected Snapdragon-based device can leverage the flaw to achieve high-impact compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon fastboot bootloader when processing commands that set the display mode allows a high-privileged local attacker with physical device access to corrupt memory and potentially execute code outside the bootloader's security context. The flaw, reported by Qualcomm and disclosed in their June 2026 security bulletin, affects Snapdragon platforms across the product line per the supplied CPE. No public exploit has been identified at the time of analysis, and the CVSS 7.2 score reflects the high privilege and physical access barriers that limit broad exploitation.
Memory corruption in Qualcomm Snapdragon fastboot bootloader processing allows a physically present attacker with high privileges to corrupt memory by submitting improperly formatted fastboot commands. The flaw carries a CVSS 7.2 score reflecting physical attack vector with scope change, and no public exploit identified at time of analysis. Disclosed in Qualcomm's June 2026 security bulletin, it affects Snapdragon platforms exposed during device provisioning, recovery, or firmware-flash workflows.
Boot flow tampering in Qualcomm Snapdragon platforms allows a local authenticated attacker to bypass cryptographic verification of partition table entries and modify the device's boot process, achieving high impact to confidentiality and integrity. Qualcomm disclosed the issue in its June 2026 security bulletin, classifying it as an authentication bypass affecting Snapdragon products. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the boot-chain location of the flaw makes it strategically valuable for persistent compromise.
Memory corruption in Qualcomm Snapdragon fastboot bootloader handling allows a privileged local attacker with physical access to corrupt memory by issuing malformed fastboot commands, with scope change (CVSS S:C) indicating impact extends beyond the bootloader's security boundary. The flaw was disclosed by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 7.2 (High). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a specific partition and load a customized (unsigned or tampered) bootloader, breaking the device's chain of trust. The flaw, reported by Qualcomm itself in its June 2026 security bulletin, carries a CVSS of 8.2 with scope change due to its impact on trusted firmware boundaries, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon fastboot OEM command handling allows a local attacker with high privileges and physical access to compromise device confidentiality, integrity, and availability. The CVSS 7.2 score reflects the physical attack vector (AV:P) offset by high impact and scope change, and no public exploit identified at time of analysis. Disclosure originates from Qualcomm's June 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon platforms stems from a stack-based memory corruption triggered while processing display command line information with an uninitialized variable. With CVSS 7.2 and a physical attack vector requiring high privileges, the flaw allows a privileged local attacker to corrupt memory and impact confidentiality, integrity, and availability across a changed security scope. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unauthenticated attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability stems from incorrect authorization logic (CWE-863) that fails to prevent buffer overflow conditions. CVSS score of 9.6 reflects adjacent network attack vector with low complexity and no required privileges or user interaction, with scope change indicating container/hypervisor escape or lateral movement potential. No CISA KEV listing or public exploit identified at time of analysis, though EPSS data not available to assess exploitation probability.
Use-after-free vulnerability in Qualcomm Snapdragon chipsets enables local privilege escalation to achieve full device compromise. Low-privilege authenticated users can trigger memory corruption during performance counter deselect operations, gaining high-integrity code execution with kernel-level access. Qualcomm has released patches in their May 2026 security bulletin. EPSS data not yet available for this future-dated CVE; no confirmed active exploitation or public exploit code identified at time of analysis.
Memory corruption in Qualcomm Snapdragon components allows local authenticated users to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability through malformed power management requests. The vulnerability stems from improper validation of input/output buffer sizes in power management handlers. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV) or public exploit code identified at time of analysis. Qualcomm addressed this in their April 2026 security bulletin.
Buffer over-read (CWE-126) in Qualcomm Snapdragon devices causes denial-of-service when processing malformed Neighborhood Awareness Networking (NAN) service data frames with excessive length values. Attack requires network proximity, high attacker privileges, user interaction, and high complexity (CVSS 7.6), yielding CVSS scope change with potential high confidentiality/integrity impact beyond availability disruption. Qualcomm April 2026 bulletin addresses this transient DOS condition. No public exploit identified at time of analysis, though the specific protocol implementation flaw in NAN device discovery presents measurable risk in adjacent network scenarios where attackers have elevated Wi-Fi protocol access.
Local privilege escalation via use-after-free in Qualcomm Snapdragon video memory management allows authenticated attackers with low privileges to achieve complete system compromise. The vulnerability exists in deprecated DMABUF IOCTL interfaces used for direct memory access buffer operations. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026 CVE. Qualcomm addressed this in their April 2026 security bulletin.
Local privilege escalation in Qualcomm Snapdragon camera sensor drivers allows authenticated users to execute arbitrary code with elevated privileges through memory corruption. The vulnerability stems from unbounded buffer access during IOCTL processing, enabling attackers to corrupt memory and achieve complete system compromise (confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis. Affects Qualcomm Snapdragon-powered devices across mobile and IoT ecosystems.
Local privilege escalation in Qualcomm Snapdragon camera sensor drivers allows authenticated attackers with low privileges to execute arbitrary code with elevated permissions through unchecked output buffer access during IOCTL operations. This out-of-bounds read vulnerability (CWE-126) achieves complete system compromise (confidentiality, integrity, and availability impact all rated High in CVSS). No public exploit identified at time of analysis, though the local attack vector and low complexity suggest proof-of-concept development is feasible for researchers with device access.
Memory corruption in Qualcomm Snapdragon chipsets allows authenticated local attackers with low privileges to execute arbitrary code, elevate privileges, or cause system crashes through improper IOCTL buffer validation. The vulnerability achieves complete compromise of confidentiality, integrity, and availability (CVSS 7.8 HIGH). No public exploit code identified at time of analysis, though exploitation requires only low attack complexity once local access is obtained. Qualcomm addressed this in their April 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon auxiliary sensor I/O control processing allows authenticated local attackers to achieve arbitrary code execution with high integrity and confidentiality impact. The vulnerability stems from insufficient buffer size validation (CWE-126: Buffer Over-read) when handling sensor control commands. With CVSS 7.8 and local attack vector requiring low privileges, this represents a moderate real-world risk for privilege escalation attacks on Android and IoT devices using affected Snapdragon chipsets. No public exploit code or CISA KEV listing identified at time of analysis, though the April 2026 bulletin date suggests recent disclosure.
Local privilege escalation in Qualcomm Snapdragon products allows authenticated attackers to gain kernel-level code execution through memory corruption during IOCTL processing. The vulnerability stems from unchecked buffer size validation when writing to output buffers, enabling high-impact compromise of confidentiality, integrity, and availability on affected mobile and embedded devices. With a CVSS score of 7.8 and low attack complexity (AC:L), this represents a significant privilege escalation vector for malicious applications or local users, though no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon components allows authenticated local attackers to corrupt kernel memory through malformed IOCTL requests. Exploitation requires low-privilege local access but no user interaction (CVSS 7.8, AV:L/PR:L). The vulnerability enables attackers to achieve high impact across confidentiality, integrity, and availability through unsafe memcpy operations that fail to validate buffer sizes. No public exploit identified at time of analysis, though the straightforward attack complexity (AC:L) suggests exploitation development is feasible for adversaries with local access.
Memory corruption in Qualcomm Snapdragon components allows local authenticated attackers to execute arbitrary code with high privileges. A buffer overflow vulnerability (CWE-126) occurs during output buffer retrieval due to insufficient size validation, enabling complete system compromise with high confidentiality, integrity, and availability impact. EPSS risk data not available; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The local attack vector (AV:L) and low complexity (AC:L) make this exploitable by malicious apps or local users on affected Snapdragon-powered devices.
Out-of-bounds read in Qualcomm Snapdragon WiFi firmware triggers denial-of-service when processing malformed FILS Discovery frames during network scans. Remote attackers on the same wireless network can crash affected devices by broadcasting specially crafted 802.11ai Fast Initial Link Setup frames with invalid action field sizes. CVSS 7.6 (High) reflects the high attack complexity and required high privileges, though the confidentiality/integrity impacts appear overstated for a transient DOS condition. EPSS data not available; no public exploit identified at time of analysis.
A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.
Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.
Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.
Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chipsets lets an attacker who has physical possession of a device feed a crafted ELF file during the early boot sequence and corrupt bootloader memory, with the scope change indicating a possible escape from the normal boot context into the secure/TrustZone world. Exploitation is highly constrained: CVSS 3.1 scores it 6.9 under a vector of AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning physical access, low-level privileges, high attack complexity (specific timing or hardware state) and user interaction are all required; the practical exposure is limited to lost or stolen devices, supply-chain interdiction, or forensic scenarios rather than remote or default network-reachable attacks. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); Qualcomm has published a security bulletin (May 2026) covering the issue.
Memory corruption in Qualcomm Snapdragon platforms allows an attacker who already holds a low-privileged local foothold on the device to corrupt memory by feeding oversized input into a copy routine that exceeds expected allocation limits, giving high impact to confidentiality, integrity, and availability of the affected component. The flaw is not remotely exploitable on its own: exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) - for example a malicious or compromised application able to reach the vulnerable code path - and no user interaction is needed. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided; the referenced Qualcomm September 2026 security bulletin is the authoritative source for the specific affected chipsets and fixed versions.
Information disclosure in Qualcomm Snapdragon chipsets exposes private data transmitted during NG-eCall SIP signaling when IPSec negotiation fails or is improperly established. Attackers adjacent to the network can intercept unprotected signaling traffic, gaining access to sensitive session data - potentially including location coordinates and caller identity transmitted as part of the automated emergency call system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Information disclosure in Qualcomm Snapdragon wireless subsystem allows an adjacent-network attacker to leak sensitive memory contents by transmitting malformed wireless channel switch frames with invalid length fields. The root cause is CWE-191 (integer underflow), where improperly formatted length values trigger an arithmetic wrap condition during 802.11 management frame parsing, resulting in out-of-bounds memory reads. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the low attack complexity and no-authentication requirement on an adjacent wireless segment represent a meaningful real-world risk for shared wireless environments.
Memory corruption in Qualcomm Snapdragon's registry value processing exposes devices to potential code execution by high-privileged local attackers. The flaw, rooted in CWE-120 (classic buffer overflow), is triggered when a direct query method processes registry values supplied with incorrect types - bypassing proper type-length validation and corrupting adjacent memory. While the full C:H/I:H/A:H impact triad indicates serious consequences if reached, the PR:H (high privilege) and AV:L (local) CVSS metrics substantially narrow the realistic attack surface. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Qualcomm Snapdragon firmware triggers an out-of-bounds write (CWE-787) when prepared commands are updated using invalid port indices supplied from user space that exceed supported read client limits. The vulnerability spans an exceptionally broad portfolio of Snapdragon chipsets covering mobile, automotive, XR/AR, and connectivity platforms. No public exploit has been identified at time of analysis, and CISA SSVC assessment rates exploitation as none and the flaw as non-automatable, though the changed scope (S:C) in the CVSS vector indicates impact can propagate beyond the directly vulnerable firmware component.
Memory corruption in Qualcomm Snapdragon silicon allows a local low-privileged attacker to trigger an out-of-bounds write (CWE-787) by submitting input with a buffer plane count or batch size exceeding the maximum allowed value. The scope change in the CVSS vector (S:C) indicates the corruption can escape the vulnerable component's security boundary, yielding partial confidentiality, integrity, and availability impact on an adjacent system component. No public exploit or active exploitation has been identified at time of analysis; SSVC confirms no known exploitation and non-automatable attack conditions.
Out-of-bounds write in Qualcomm Snapdragon's flash command handler allows a local low-privileged attacker to corrupt memory by exploiting a race condition between userspace LED count modifications and kernel-side flash command processing. The CVSS scope change (S:C) indicates the corruption can reach components beyond the immediately vulnerable driver - raising the potential for privilege escalation on affected Snapdragon-based devices. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in Qualcomm Snapdragon's JPEG command parser exposes local low-privilege users to memory corruption via crafted JPEG input. Validation checks within the parser fail to account for extra buffer writes, overwriting adjacent memory and enabling a scope change beyond the vulnerable component's boundary - consistent with Snapdragon's isolated subsystem architecture (DSP, camera ISP). Qualcomm disclosed this in its July 2026 Security Bulletin; no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in Qualcomm Snapdragon chipset drivers allows a malicious application to trigger a use-after-free by issuing multiple IOCTL calls that reference the same buffer file descriptor. The flaw affects a broad range of Snapdragon mobile, compute, connectivity (FastConnect/WCN/WCD/WSA) and XR platforms, and successful exploitation can corrupt kernel memory to gain high impact on confidentiality, integrity and availability. There is no public exploit identified at time of analysis, EPSS risk is very low (0.09%), and CISA SSVC rates exploitation as none.
Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to trigger access of already-freed memory by issuing multiple IOCTL calls that reference the same buffer file descriptor. A successful attacker gains full compromise of confidentiality, integrity, and availability on the affected device, which in practice can mean kernel-level code execution or privilege escalation from an unprivileged app. There is no public exploit identified at time of analysis, EPSS is negligible (0.09%, 1st percentile), and CISA SSVC records no known exploitation.
Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-after-free condition in the device driver's input/output control (ioctl) path for mapping and unmapping persistent memory buffers can be triggered by an authenticated local application. Improper synchronization on these operations lets a low-privileged process corrupt kernel memory to gain full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.09%), consistent with CISA SSVC scoring exploitation as none.
Memory corruption in Qualcomm Snapdragon platforms allows a locally privileged attacker to trigger an out-of-bounds write by issuing a random number generator (RNG) command paired with an undersized output buffer, yielding complete confidentiality, integrity, and availability impact. The vulnerability requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H), placing the base score at 6.7 (Medium) despite the high C/I/A ratings. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack-based buffer overflow in Qualcomm Snapdragon corrupts memory during a data copy operation when the output buffer is sized smaller than the input buffer, enabling a high-privileged local attacker to achieve full compromise of confidentiality, integrity, and availability on affected devices. Rooted in CWE-121, this vulnerability can allow control-flow hijacking via stack memory overwrite on Snapdragon-based platforms. No public exploit identified at time of analysis and no CISA KEV listing, but the high-impact triad (C:H/I:H/A:H) warrants prompt patching in environments where privileged access is shared or contested.
Stack-based buffer overflow in Qualcomm Snapdragon Windows drivers allows a locally authenticated high-privilege attacker to cause memory corruption by sending a malformed trusted application request. The vulnerability affects Snapdragon-based systems running Windows drivers and can result in complete compromise of confidentiality, integrity, and availability. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Memory corruption via out-of-bounds write in Qualcomm Snapdragon diagnostic services allows a local, highly-privileged attacker to achieve high-impact compromise of confidentiality, integrity, and availability. The root cause is absent input validation in the diagnostic services component, enabling a crafted payload to corrupt memory. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Memory corruption in Qualcomm Snapdragon affects the IOCTL request processing path, exploitable by a local attacker with high privileges who can win a race condition between API version validation and user-space buffer consumption. Successful exploitation yields high-impact confidentiality, integrity, and availability compromise despite the moderate overall CVSS score of 6.4, which is suppressed by the high attack complexity and privilege requirements. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate widespread risk.
Qualcomm Snapdragon chipsets improperly parse 802.11 advertisement frames containing malformed MBSSID (Multiple BSSID) elements of insufficient length, triggering a buffer over-read that discloses memory contents to an attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C) indicates network-reachable exploitation with changed scope, meaning the impact crosses beyond the Wi-Fi subsystem into adjacent components. No public exploit identified at time of analysis, and no CISA KEV listing exists; Qualcomm addressed this in their June 2026 Security Bulletin.
Local privilege escalation and memory corruption in Qualcomm Snapdragon platforms allows an attacker with low-privileged local access to corrupt memory during secure data initialization, leading to high impact on confidentiality, integrity, and availability. The flaw is traceable to a NULL pointer dereference (CWE-476) reachable when heap memory is exhausted, and is addressed in the Qualcomm June 2026 security bulletin. No public exploit identified at time of analysis, and EPSS data was not provided.
Local privilege escalation via memory corruption in Qualcomm Snapdragon platform components allows an authenticated low-privileged local attacker to corrupt memory by supplying device identifier strings exceeding the expected maximum length. The CVSS 7.8 (AV:L/AC:L/PR:L) profile combined with CWE-787 out-of-bounds write indicates a classic stack/heap overflow path that can be leveraged for code execution with full confidentiality, integrity, and availability impact on affected devices. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.