Qualcomm Snapdragon Xr2 5g Platform Firmware vulnerabilities

CVE-2026-25302 High · 7.1 CWE-347 Oct 6, 2026

Improper Verification of Cryptographic Signature in Boot

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

CVE-2026-25273 Medium · 6.7 CWE-787 Oct 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.

CVE-2026-25272 Medium · 6.7 CWE-787 Oct 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.

CVE-2026-25270 Medium · 6.7 CWE-787 Oct 6, 2026

Out-of-bounds Write in Camera Driver

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

CVE-2026-25269 Medium · 6.7 CWE-787 Oct 6, 2026

Out-of-bounds Write in Camera Driver

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.

CVE-2026-25267 High · 7.8 CWE-862 Oct 6, 2026

Missing Authorization in Core

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVE-2026-25263 Medium · 6.6 CWE-787 Oct 6, 2026

Out of Bounds write in Linux Camera

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVE-2026-25275 High · 7.5 CWE-126 Sep 17, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

CVE-2026-25292 High · 7.6 CWE-1286 Aug 4, 2026

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

CVE-2026-24077 Medium · 6.5 CWE-191 Aug 4, 2026

Integer Underflow (Wrap or Wraparound) in WLAN Host

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

CVE-2026-21384 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

CVE-2026-21370 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

CVE-2026-21369 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

CVE-2026-21368 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.

CVE-2025-59617 High · 7.3 CWE-416 Jul 6, 2026

Use After Free in Computer Vision

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

CVE-2025-59616 High · 7.8 CWE-416 Jul 6, 2026

Use After Free in Computer Vision

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

CVE-2025-59615 High · 7.8 CWE-416 Jul 6, 2026

Use After Free in Computer Vision

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

CVE-2026-25277 High · 8.8 CWE-120 Jun 1, 2026

Buffer Copy Without Checking Size of Input in Secure Processor

Memory corruption while using Strongbox due to buffer overflow.

CVE-2026-25276 High · 8.8 CWE-129 Jun 1, 2026

Improper Validation of Array Index in Secure Processor

Memory corruption while using Strongbox due to missing bounds check.

CVE-2026-25260 High · 7.0 CWE-367 Jun 1, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.

CVE-2026-25259 High · 7.8 CWE-787 Jun 1, 2026

Out-of-bounds Write in DSP Service

Memory corruption while processing multiple IOCTL command for escape operations.

CVE-2026-24092 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Display

Memory Corruption when processing fastboot commands to set display mode.

CVE-2026-24091 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption while processing fastboot commands with improperly formatted input.

CVE-2026-24090 High · 7.1 CWE-306 Jun 1, 2026

Missing Authentication for Critical Function in HLOS

Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

CVE-2026-24089 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Kernel

Memory corruption while processing fastboot commands with invalid input.