CVE-2026-25269: CWE-787: Out-of-bounds Write in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25269) is an out-of-bounds write (CWE-787) in Qualcomm Snapdragon devices. It occurs when the camera processing component handles requests with excessive batch and IO buffer configurations that exceed the allocated memory size, causing memory corruption. The CVSS 3.1 base score is 6.7 (medium severity) with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. The affected versions are specific Snapdragon chipsets identified by their model numbers. There is no vendor advisory or patch information provided in the input data.

Successful exploitation can cause memory corruption leading to potential compromise of confidentiality, integrity, and availability of the affected device. Given the local attack vector and high privileges required, exploitation would likely require privileged access on the device. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit access to privileged accounts and avoid processing untrusted or malformed camera requests with excessive batch or IO buffer configurations.