Qualcomm Inc

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-25254	Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.	CRITICAL	9.8	0.7%	50	No patch
CVE-2026-25289	Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.	CRITICAL	9.6	0.2%	48	No patch
CVE-2026-25264	Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.	HIGH	8.8	0.2%	44	No patch
CVE-2026-25265	Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.	HIGH	8.8	0.2%	44	No patch
CVE-2026-25283	Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.	HIGH	8.8	0.1%	44	No patch
CVE-2026-24079	Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.	HIGH	8.1	0.2%	41	No patch
CVE-2026-25282	Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.	HIGH	7.9	0.1%	40	No patch
CVE-2026-24073	Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.	HIGH	7.8	0.2%	39	No patch
CVE-2026-24074	Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.	HIGH	7.8	0.2%	39	No patch
CVE-2026-25255	Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.	HIGH	7.8	0.2%	39	No patch
CVE-2026-57545	Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-25261	Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.	HIGH	7.8	0.1%	39	No patch
CVE-2026-21366	Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.	HIGH	7.8	0.1%	39	No patch
CVE-2026-24080	Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.	HIGH	7.8	0.1%	39	No patch
CVE-2026-24083	Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.	HIGH	7.8	0.1%	39	No patch

CVE-2026-25254

Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.

CRITICAL

9.8

0.7%

50

No patch

CVE-2026-25289

Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.

CRITICAL

9.6

0.2%

48

No patch

CVE-2026-25264

Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.

HIGH

8.8

0.2%

44

No patch

CVE-2026-25265

Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.

HIGH

8.8

0.2%

44

No patch

CVE-2026-25283

Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.

HIGH

8.8

0.1%

44

No patch

CVE-2026-24079

Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.

HIGH

8.1

0.2%

41

No patch

CVE-2026-25282

Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.

HIGH

7.9

0.1%

40

No patch

CVE-2026-24073

Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.

HIGH

7.8

0.2%

39

No patch

CVE-2026-24074

Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.

HIGH

7.8

0.2%

39

No patch

CVE-2026-25255

Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.

HIGH

7.8

0.2%

39

No patch

CVE-2026-57545

Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-25261

Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.

HIGH

7.8

0.1%

39

No patch

CVE-2026-21366

Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.

HIGH

7.8

0.1%

39

No patch

CVE-2026-24080

Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.

HIGH

7.8

0.1%

39

No patch

CVE-2026-24083

Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.

HIGH

7.8

0.1%

39

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs