CVE-2026-25274: CWE-416 Use After Free in Qualcomm, Inc. Snapdragon

CVE-2026-25274 is a use-after-free vulnerability (CWE-416) in Qualcomm Snapdragon products. It arises from improper synchronization when processing concurrent DMA buffer allocation and deallocation commands, leading to memory corruption. This flaw can be exploited to compromise confidentiality, integrity, and availability of affected devices. The vulnerability affects specific Qualcomm Snapdragon versions identified by model numbers such as AQT1000, IQX5121, QCA0000, and others. The CVSS v3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting a medium severity level. There is no vendor advisory or patch information provided at this time, and no known exploits have been reported.

Successful exploitation of this use-after-free vulnerability can result in memory corruption that impacts confidentiality, integrity, and availability of the affected Qualcomm Snapdragon devices. The CVSS vector indicates that an attacker with high privileges on the local system can cause significant damage without user interaction. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, monitor Qualcomm's advisories for updates. Until a patch is available, limit access to privileged accounts and avoid running untrusted code with high privileges to reduce risk.