CVE-2026-57555: CWE-416 Use After Free in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-57555) is a use-after-free (CWE-416) memory corruption issue in Qualcomm Snapdragon devices. It occurs when system service routines improperly handle user input buffers, leading to potential memory corruption. The CVSS 3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality, integrity, and availability loss. Multiple Snapdragon product versions are affected, including IQX5121, QCA0000, QCM5430, QCM6490, WCD9370, WCD9375, WCD9380, WCD9385, WSA8835, WSA8840, and WSA8845. There is no information about available patches or vendor advisories, and no known exploits in the wild have been reported.

Successful exploitation can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service, impacting confidentiality, integrity, and availability of the affected device. The vulnerability requires local access with low privileges and no user interaction, making exploitation feasible in certain scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to trusted users and monitor for updates from Qualcomm regarding patches or mitigations.