Qualcomm Inc

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-57545	Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-25291	Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.	HIGH	7.8	0.1%	39	No patch
CVE-2026-57537	Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.	HIGH	7.8	0.1%	39	No patch
CVE-2026-57554	Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.	HIGH	7.8	0.1%	39	No patch
CVE-2026-57555	Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-57559	Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-25267	Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-57546	A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.	HIGH	7.5	0.3%	38	No patch
CVE-2026-25302	Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.	HIGH	7.1	0.1%	36	No patch
CVE-2026-25269	Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.	MEDIUM	6.7	0.1%	34	No patch
CVE-2026-25270	Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.	MEDIUM	6.7	0.1%	34	No patch
CVE-2026-25272	Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.	MEDIUM	6.7	0.1%	34	No patch
CVE-2026-25273	Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.	MEDIUM	6.7	0.1%	34	No patch
CVE-2026-25274	A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.	MEDIUM	6.7	0.1%	34	No patch
CVE-2026-25263	Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.	MEDIUM	6.6	0.1%	33	No patch

CVE-2026-57545

Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-25291

Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.

HIGH

7.8

0.1%

39

No patch

CVE-2026-57537

Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.

HIGH

7.8

0.1%

39

No patch

CVE-2026-57554

Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.

HIGH

7.8

0.1%

39

No patch

CVE-2026-57555

Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-57559

Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-25267

Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-57546

A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.

HIGH

7.5

0.3%

38

No patch

CVE-2026-25302

Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.

HIGH

7.1

0.1%

36

No patch

CVE-2026-25269

Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.

MEDIUM

6.7

0.1%

34

No patch

CVE-2026-25270

Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.

MEDIUM

6.7

0.1%

34

No patch

CVE-2026-25272

Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.

MEDIUM

6.7

0.1%

34

No patch

CVE-2026-25273

Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.

MEDIUM

6.7

0.1%

34

No patch

CVE-2026-25274

A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.

MEDIUM

6.7

0.1%

34

No patch

CVE-2026-25263

Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.

MEDIUM

6.6

0.1%

33

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs