This vulnerability (CVE-2026-25276) is classified as CWE-129: Improper Validation of Array Index. It occurs in Qualcomm Snapdragon mobile platforms due to a missing bounds check in the Strongbox component, resulting in memory corruption. The CVSS v3.1 base score is 8.8, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, and scope changed. The impact includes high confidentiality, integrity, and availability impacts. The vulnerability affects multiple Snapdragon platforms released by Qualcomm. No patch or official remediation level has been published by the vendor as of the information provided.

Successful exploitation can lead to memory corruption, which may allow an attacker with local access and low privileges to escalate privileges or execute arbitrary code, compromising confidentiality, integrity, and availability of the affected device. The scope of impact is changed, meaning the vulnerability affects components beyond the initially vulnerable component. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by Qualcomm, users and administrators should monitor Qualcomm's advisories for updates. Until a patch is available, limiting local access to trusted users and minimizing exposure to untrusted applications may reduce risk.