This vulnerability (CVE-2026-25276) in Qualcomm Snapdragon 8 Gen 2, 8+ Gen 2, 8 Gen 3, 8 Elite, and 8 Elite Gen 5 Mobile Platforms is caused by improper validation of an array index (CWE-129) in the Strongbox component. The missing bounds check can lead to memory corruption, potentially allowing an attacker with local privileges to compromise system confidentiality, integrity, and availability. The CVSS 3.1 vector indicates low attack complexity, low privileges required, no user interaction, and scope change, with high impact on all security properties. The vendor has not provided a patch or official remediation at this time.

Successful exploitation can result in memory corruption, which may lead to arbitrary code execution or system compromise affecting confidentiality, integrity, and availability of the device. The vulnerability requires local access with low privileges and does not require user interaction. The scope of impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations or workarounds have been provided by Qualcomm at this time.