CVE-2026-25302: CWE-347: Improper Verification of Cryptographic Signature in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25302) involves improper verification of cryptographic signatures (CWE-347) in Qualcomm Snapdragon devices. Specifically, when processing non-ELF partitions, the authentication and signature checks can be bypassed, allowing unsigned or corrupted images to be mounted and processed by the system. This cryptographic issue affects a wide range of Snapdragon product versions explicitly enumerated. The CVSS v3.1 score is 7.1, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. There is no information about available patches or vendor advisories indicating remediation status.

The vulnerability allows attackers with local access and low privileges to bypass cryptographic signature verification on non-ELF partitions, enabling mounting and processing of unsigned or corrupted images. This can lead to high confidentiality impact and high availability impact, such as denial of service or unauthorized data exposure. Integrity impact is not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Qualcomm's advisories for updates. Until a fix is available, restrict local access to affected devices and avoid processing untrusted non-ELF partitions.