CVE-2026-25272: CWE-787: Out-of-bounds Write in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25272) is an out-of-bounds write (CWE-787) in Qualcomm Snapdragon devices occurring during processing of camera CRE driver operations. The flaw arises from improper handling of buffer limits during hardware update preparation, leading to memory corruption. The CVSS 3.1 base score is 6.7 (medium severity) with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The affected products include a broad range of Snapdragon chipsets identified by specific model numbers. No official patch or remediation details are currently available from the vendor, and no exploits are known in the wild.

Successful exploitation of this vulnerability can result in memory corruption, potentially allowing an attacker with high privileges and local access to compromise confidentiality, integrity, and availability of the affected device. The flaw affects camera driver operations, which may impact device stability and security. However, exploitation requires high privileges and local access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users and monitor for updates from Qualcomm regarding patches or mitigations for this vulnerability.