CVE-2026-25267: CWE-862: Missing Authorization in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25267) involves a missing authorization (CWE-862) in Qualcomm Snapdragon devices. Specifically, the non-secure loader can rewrite page tables prior to secure memory initialization, causing memory corruption. The issue affects a wide range of Snapdragon chip versions identified explicitly by their model numbers. The CVSS 3.1 base score is 7.8 with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to memory corruption, potentially allowing an attacker with local access and low privileges to compromise system confidentiality, integrity, and availability. The vulnerability affects the secure boot or memory initialization process, which is critical for device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Qualcomm's advisories for updates. Until a fix is available, restricting local access and ensuring secure boot configurations may help reduce risk.