22
CVEs
1
Critical
14
High
0
KEV
0
PoC
15
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
14
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-25289 | Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV. | CRITICAL | 9.6 | 0.2% | 48 |
No patch
|
| CVE-2026-25268 | Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malformed HT40 (40 MHz channel-bonding) layouts during dynamic channel switching, allowing a low-privileged local process to trigger a stack-based buffer overflow (CWE-121) that crosses a trust boundary (CVSS scope changed). Disclosed in the July 2026 Qualcomm security bulletin, it carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-24079 | Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-21379 | Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with sizes exceeding the maximum allowed value corrupts adjacent memory (CWE-126, buffer over-read/overflow). A local attacker with low privileges (PR:L) and no user interaction can compromise confidentiality, integrity, and availability (all High), scoring CVSS 7.8. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-21366 | Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-24080 | Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-24083 | Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2025-59615 | Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-after-free condition in the device driver's input/output control (ioctl) path for mapping and unmapping persistent memory buffers can be triggered by an authenticated local application. Improper synchronization on these operations lets a low-privileged process corrupt kernel memory to gain full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.09%), consistent with CISA SSVC scoring exploitation as none. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2025-59616 | Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to trigger access of already-freed memory by issuing multiple IOCTL calls that reference the same buffer file descriptor. A successful attacker gains full compromise of confidentiality, integrity, and availability on the affected device, which in practice can mean kernel-level code execution or privilege escalation from an unprivileged app. There is no public exploit identified at time of analysis, EPSS is negligible (0.09%, 1st percentile), and CISA SSVC records no known exploitation. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-25292 | Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis. | HIGH | 7.6 | 0.2% | 38 |
No patch
|
| CVE-2026-24084 | Qualcomm Snapdragon chipsets fail to verify the consistency of UE security capabilities against those replayed by the network during 3GPP cellular security mode negotiation, enabling a rogue base station operator to force downgraded cryptographic algorithm selection on unpatched devices. The flaw resides in the cellular modem firmware stack and affects all Snapdragon product lines per available CPE data, with no minimum version boundary published. Exploitation yields high confidentiality impact - a sophisticated attacker with radio interception equipment can potentially decrypt cellular communications. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the underlying attack class (security capability bidding-down) is well-documented in cellular security research. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-25288 | Transient denial of service in Qualcomm Snapdragon's Wi-Fi 6 stack allows adjacent, unauthenticated attackers to crash affected devices by transmitting a malformed Target Wake Time (TWT) channel usage response frame with an undersized packet payload. The CVSS scope change (S:C) indicates the crash propagates beyond the Wi-Fi subsystem to impact the broader host environment. No public exploit code and no CISA KEV listing have been identified at time of analysis. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2025-59617 | Local privilege escalation and memory corruption in Qualcomm Snapdragon chipset drivers allows a malicious application to trigger a use-after-free by issuing multiple IOCTL calls that reference the same buffer file descriptor. The flaw affects a broad range of Snapdragon mobile, compute, connectivity (FastConnect/WCN/WCD/WSA) and XR platforms, and successful exploitation can corrupt kernel memory to gain high impact on confidentiality, integrity and availability. There is no public exploit identified at time of analysis, EPSS risk is very low (0.09%), and CISA SSVC rates exploitation as none. | HIGH | 7.3 | 0.1% | 37 |
No patch
|
| CVE-2026-21383 | Sensitive key material can be exposed in Qualcomm Snapdragon platforms because AES-GCM key wrapping is performed with a hardcoded/static initialization vector instead of a unique per-call nonce. A local, low-privileged attacker who can collect multiple wrapped outputs can exploit the resulting IV/nonce reuse to recover confidentiality and forge integrity of wrapped keys. There is no public exploit identified at time of analysis, and the issue is disclosed via Qualcomm's July 2026 security bulletin. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-25271 | Local privilege escalation via memory corruption in Qualcomm Snapdragon platforms occurs when asynchronous input parameters are validated and then re-read after modification, a time-of-check/time-of-use race that yields total compromise of confidentiality, integrity, and availability. Affecting a broad range of Snapdragon connectivity, WCD codec, WSA, and compute SoCs, a local low-privileged attacker who can win the race can corrupt memory and gain elevated code execution. No public exploit has been identified at time of analysis and EPSS is negligible (0.09%), but the CVSS 7.0 and 'total' SSVC technical impact make it a meaningful firmware/driver patch target. | HIGH | 7.0 | 0.1% | 35 |
No patch
|