Qualcomm Inc

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-25254	Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.	CRITICAL	9.8	0.7%	50	No patch
CVE-2026-25293	Buffer overflow in Qualcomm QCA7005 power-line communication (PLC) firmware can be reached by an unauthenticated attacker who can access the PLC interface, where an incorrect-authorization condition (CWE-863) permits an unauthorized request to trigger the overflow and cause high confidentiality, integrity, and availability impact. The CVE record carries a 9.8 AV:N score, but the independent assessment narrows the attack vector to adjacent (AV:A), and no public exploit or active exploitation is identified. The act_now priority label conflicts with the 0.02% EPSS (6th percentile) and SSVC exploitation:none signals, so urgency should be validated rather than assumed.	CRITICAL	9.8	0.0%	49	No patch
CVE-2026-25289	Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.	CRITICAL	9.6	0.2%	48	No patch
CVE-2026-25264	Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.	HIGH	8.8	0.2%	44	No patch
CVE-2026-25265	Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.	HIGH	8.8	0.2%	44	No patch
CVE-2026-25268	Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.	HIGH	8.8	0.1%	44	No patch
CVE-2026-25283	Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.	HIGH	8.8	0.1%	44	No patch
CVE-2026-25276	Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox trusted execution component, where a missing bounds check enables memory corruption from a low-privileged context. A successful exploit crosses a trust boundary (CVSS scope=Changed) and yields high impact to confidentiality, integrity, and availability on the affected device. No public exploit identified at time of analysis, and EPSS data was not provided alongside this advisory.	HIGH	8.8	0.0%	44	No patch
CVE-2026-25277	Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer overflow that crosses a security boundary (scope changed) and compromises confidentiality, integrity, and availability of the device. The flaw is reported directly by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 8.8 with no public exploit identified at time of analysis. Strongbox is the hardware-backed keystore used to protect cryptographic material, so successful exploitation undermines a core trust component of Snapdragon-based mobile platforms.	HIGH	8.8	0.0%	44	No patch
CVE-2026-24088	Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a specific partition and load a customized (unsigned or tampered) bootloader, breaking the device's chain of trust. The flaw, reported by Qualcomm itself in its June 2026 security bulletin, carries a CVSS of 8.2 with scope change due to its impact on trusted firmware boundaries, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.	HIGH	8.2	0.0%	41	No patch
CVE-2026-24079	Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.	HIGH	8.1	0.2%	41	No patch
CVE-2026-25282	Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.	HIGH	7.9	0.1%	40	No patch
CVE-2026-24073	Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.	HIGH	7.8	0.2%	39	No patch
CVE-2026-24074	Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.	HIGH	7.8	0.2%	39	No patch
CVE-2026-25255	Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.	HIGH	7.8	0.2%	39	No patch

CVE-2026-25254

Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.

CRITICAL

9.8

0.7%

50

No patch

CVE-2026-25293

Buffer overflow in Qualcomm QCA7005 power-line communication (PLC) firmware can be reached by an unauthenticated attacker who can access the PLC interface, where an incorrect-authorization condition (CWE-863) permits an unauthorized request to trigger the overflow and cause high confidentiality, integrity, and availability impact. The CVE record carries a 9.8 AV:N score, but the independent assessment narrows the attack vector to adjacent (AV:A), and no public exploit or active exploitation is identified. The act_now priority label conflicts with the 0.02% EPSS (6th percentile) and SSVC exploitation:none signals, so urgency should be validated rather than assumed.

CRITICAL

9.8

0.0%

49

No patch

CVE-2026-25289

Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.

CRITICAL

9.6

0.2%

48

No patch

CVE-2026-25264

Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.

HIGH

8.8

0.2%

44

No patch

CVE-2026-25265

Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.

HIGH

8.8

0.2%

44

No patch

CVE-2026-25268

Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

HIGH

8.8

0.1%

44

No patch

CVE-2026-25283

Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.

HIGH

8.8

0.1%

44

No patch

CVE-2026-25276

Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox trusted execution component, where a missing bounds check enables memory corruption from a low-privileged context. A successful exploit crosses a trust boundary (CVSS scope=Changed) and yields high impact to confidentiality, integrity, and availability on the affected device. No public exploit identified at time of analysis, and EPSS data was not provided alongside this advisory.

HIGH

8.8

0.0%

44

No patch

CVE-2026-25277

Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer overflow that crosses a security boundary (scope changed) and compromises confidentiality, integrity, and availability of the device. The flaw is reported directly by Qualcomm in the June 2026 security bulletin and carries a CVSS 3.1 base score of 8.8 with no public exploit identified at time of analysis. Strongbox is the hardware-backed keystore used to protect cryptographic material, so successful exploitation undermines a core trust component of Snapdragon-based mobile platforms.

HIGH

8.8

0.0%

44

No patch

CVE-2026-24088

Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a specific partition and load a customized (unsigned or tampered) bootloader, breaking the device's chain of trust. The flaw, reported by Qualcomm itself in its June 2026 security bulletin, carries a CVSS of 8.2 with scope change due to its impact on trusted firmware boundaries, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.

HIGH

8.2

0.0%

41

No patch

CVE-2026-24079

Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.

HIGH

8.1

0.2%

41

No patch

CVE-2026-25282

Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.

HIGH

7.9

0.1%

40

No patch

CVE-2026-24073

Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.

HIGH

7.8

0.2%

39

No patch

CVE-2026-24074

Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.

HIGH

7.8

0.2%

39

No patch

CVE-2026-25255

Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.

HIGH

7.8

0.2%

39

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs