Threat database

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

CVE-2026-24078 is an information disclosure vulnerability in Qualcomm Snapdragon products that occurs when IPSec negotiation fails or is not properly established during NG-eCall SIP signaling. This flaw can expose private personal information to unauthorized actors. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. The affected products include a broad range of Qualcomm Snapdragon chipsets and related components.

CVE-2026-24077 is an integer underflow vulnerability (CWE-191) in Qualcomm Snapdragon products that can lead to information disclosure when processing wireless network channel switch information with improperly formatted length fields. The vulnerability has a CVSS score of 6.5, indicating a medium severity. It affects a wide range of Qualcomm Snapdragon chipsets and related components. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-24076 is a medium severity buffer overflow vulnerability in Qualcomm Snapdragon products. It involves memory corruption when processing registry values with incorrect types using a direct query method. The flaw is categorized as CWE-120, a classic buffer overflow due to copying data without checking input size. No official patch or remediation information is currently available. The vulnerability affects multiple Snapdragon chipsets and related products. There are no known exploits in the wild at this time.

CVE-2026-21366 is a high-severity integer overflow vulnerability in Qualcomm Snapdragon chipsets QCA6595 and QCA6696. It involves memory corruption triggered by processing packets with sizes near the maximum allowed value. This flaw can lead to high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

CVE-2026-25277 is a high-severity buffer overflow vulnerability in Qualcomm Snapdragon platforms related to memory corruption when using Strongbox. It affects multiple Snapdragon 8 series mobile platforms. The vulnerability allows an attacker with local privileges to cause a buffer overflow, potentially leading to complete confidentiality, integrity, and availability compromise. No official patch or remediation guidance is currently available.

CVE-2026-25276 is a high-severity vulnerability in Qualcomm Snapdragon platforms involving improper validation of array index, leading to memory corruption when using Strongbox due to a missing bounds check. It affects multiple Snapdragon 8 series mobile platforms. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-25260 is a high-severity vulnerability in Qualcomm Snapdragon products involving a time-of-check to time-of-use (TOCTOU) race condition. It results in memory corruption due to accessing shared buffers without validating concurrent modifications from user-mode input. This vulnerability affects multiple Snapdragon components and chipsets. No official patch or remediation guidance has been provided yet.

CVE-2026-25259 is a high-severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to memory corruption when processing multiple IOCTL commands for escape operations. The flaw affects various Snapdragon components and chipsets. It has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available. There are no known exploits in the wild at this time.