Threat database

CVE-2026-24082 is a high-severity use-after-free vulnerability in Qualcomm Snapdragon products. It involves memory corruption triggered when copying data from a freed source during a performance counter deselect operation. This vulnerability affects a wide range of Snapdragon platforms and related Qualcomm hardware. Exploitation could lead to high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Patch status is not confirmed as no official fix or remediation details are provided by the vendor at this time.

CVE-2025-47408 is a high-severity vulnerability in Qualcomm Snapdragon components where memory corruption can occur if another driver issues an IOCTL call with invalid input or output buffers. This issue involves untrusted pointer dereference, classified under CWE-822. The vulnerability affects multiple Snapdragon platforms and related components. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild. The vulnerability has a CVSS score of 7.8, indicating a significant impact on confidentiality, integrity, and availability if exploited.

CVE-2025-47407 is a high-severity vulnerability in Qualcomm Snapdragon products involving a time-of-check to time-of-use (TOCTOU) race condition. The issue causes memory corruption during process creation on the digital signal processor due to allocation failure at the kernel level. This vulnerability affects a wide range of Snapdragon platforms and related components. There is no vendor-provided patch or official remediation guidance available at this time. Exploits in the wild have not been reported. The vulnerability has a CVSS score of 7.8, indicating significant confidentiality, integrity, and availability impacts.

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

CVE-2025-47405 is a high-severity vulnerability in Qualcomm Snapdragon components that causes memory corruption when processing camera sensor input/output control codes with invalid output buffers. This issue involves untrusted pointer dereference (CWE-822) and affects multiple Snapdragon platforms and related hardware. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Transient DOS when processing target power rate tables during channel configuration.

Memory Corruption when handling power management requests with improperly sized input/output buffers.

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

Memory Corruption when retrieving output buffer with insufficient size validation.

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

Cryptographic issue while copying data to a destination buffer without validating its size.