This vulnerability (CVE-2026-24090) affects Qualcomm Snapdragon products and is classified under CWE-306 (Missing Authentication for Critical Function). It arises from a cryptographic weakness in handling partition table entries, enabling unauthorized actors with limited privileges to modify the device boot flow. The CVSS 3.1 vector indicates local attack vector with low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity but not availability. The vendor has published the vulnerability but has not provided an official fix or remediation level. No known exploits have been reported.

Successful exploitation could allow an attacker with local access and limited privileges to alter the boot process of affected Snapdragon devices, potentially compromising system integrity and confidentiality. This could lead to unauthorized code execution or persistent compromise at boot time. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been provided by Qualcomm, users and administrators should monitor Qualcomm's advisories for updates. Until a patch is available, restricting local access and limiting privilege escalation opportunities may reduce risk.