CVE-2026-25276: Qualcomm Cq8750m Buffer Overflow Flaw

CVE-2026-25276 Overview

CVE-2026-25276 is a memory corruption vulnerability affecting Qualcomm Strongbox across a broad range of Snapdragon mobile platforms, FastConnect connectivity solutions, and audio codecs. The flaw stems from a missing bounds check in the Strongbox component, classified under [CWE-129: Improper Validation of Array Index]. A local attacker with low privileges can trigger memory corruption that crosses trust boundaries, given the scope-changed Common Vulnerability Scoring System (CVSS) vector. Qualcomm published the issue in its June 2026 security bulletin covering more than 50 firmware components including the Snapdragon 8 Elite, Snapdragon 8 Gen 3, and several wearable and XR platforms.

Critical Impact
A local low-privileged process can corrupt Strongbox memory, potentially compromising the confidentiality, integrity, and availability of a hardware-backed keystore used to protect cryptographic material on Snapdragon devices.

Affected Products

Qualcomm Snapdragon mobile platforms including Snapdragon 8 Elite, Snapdragon 8 Elite Gen 5, Snapdragon 8 Gen 2/3, Snapdragon 8+ Gen 2, Snapdragon 865/865+/870 5G, Snapdragon 460, and Snapdragon 662
Qualcomm FastConnect 6700, 6800, 6900, and 7800 connectivity subsystems
Qualcomm XR and AR platforms (Snapdragon XR2 5G, XR2+ Gen 1, AR1 Gen 1), automotive/IoT chips (QCM5430, QCM6490, QCM8838, QCS8550), audio codecs (WCD93xx, WSA88xx series), and Wi-Fi/modem firmware (QCN9011/9012, Snapdragon X55, SDR753)

Discovery Timeline

2026-06-01 - CVE-2026-25276 published to the National Vulnerability Database
2026-06-01 - Qualcomm publishes the June 2026 Security Bulletin documenting the flaw
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-25276

Vulnerability Analysis

Qualcomm Strongbox is the hardware-backed keystore implementation that runs in a Trusted Execution Environment (TEE) on Snapdragon devices. It stores cryptographic keys, performs key attestation, and enforces user authentication for sensitive operations such as biometric unlock and payment authorization. The vulnerability arises when Strongbox processes an attacker-supplied index or length parameter without validating that the value falls within the expected array bounds. Operations on the out-of-range index then read or write memory outside the intended buffer, corrupting adjacent data structures inside the trusted component.

Because the issue lives in code executing at a higher trust level than the calling process, successful exploitation crosses a security boundary. The CVSS scope change (S:C) reflects that a low-privileged caller in the normal world can affect resources owned by the secure world. Impact extends to all three pillars of confidentiality, integrity, and availability of keystore-managed assets.

Root Cause

The root cause is improper validation of an array index ([CWE-129]) prior to a memory access inside the Strongbox handler. Input from a lower-privileged client is consumed and used as an offset or length without being constrained against the size of the destination structure, producing an out-of-bounds read or write.

Attack Vector

Exploitation requires local code execution on the device with low privileges. An attacker who controls a normal-world application or a compromised system service can craft a request to Strongbox that supplies an out-of-bounds index, then triggers the vulnerable code path. No user interaction is needed. Remote exploitation is not possible without first achieving local execution, but malicious applications, supply-chain compromise of installed apps, or chained vulnerabilities in higher-level services are plausible delivery paths.

No public proof-of-concept code is available. See the Qualcomm Security Bulletin June 2026 for vendor technical details.

Detection Methods for CVE-2026-25276

Indicators of Compromise

Unexpected crashes, panics, or reboots referencing Strongbox, the keystore service, or the TEE in device logs (logcat, dmesg, vendor crash dumps)
Repeated Strongbox or keystore HAL invocations from a single non-system application within a short window
Failed cryptographic operations or key attestation errors that did not previously occur on the device

Detection Strategies

Monitor mobile device management (MDM) telemetry for devices running firmware levels predating the June 2026 Qualcomm patch.
Correlate application installation events with subsequent keystore or TEE error messages to identify suspicious callers.
Use mobile threat defense agents to flag applications invoking low-level keystore APIs with anomalous parameters or frequency.

Monitoring Recommendations

Track Android Security Patch Level (SPL) across the fleet and alert on devices that do not advance to the June 2026 or later patch level.
Forward device crash and reboot telemetry to a centralized log platform for baseline deviation analysis.
Audit installed applications for those requesting keystore or hardware-backed credential APIs and review their provenance.

How to Mitigate CVE-2026-25276

Immediate Actions Required

Apply the June 2026 Qualcomm security patch as soon as it is delivered by the device OEM through the standard Android update channel.
Inventory devices in the fleet against the list of affected Snapdragon, FastConnect, WCD, WSA, and QCN components and prioritize patching for high-value users.
Restrict installation of untrusted applications via MDM policy until patches are deployed.

Patch Information

Qualcomm addressed the vulnerability in the June 2026 security bulletin. Patches are distributed to original equipment manufacturers (OEMs) and reach end-user devices through OEM and carrier firmware updates. Refer to the Qualcomm Security Bulletin June 2026 for the authoritative list of fixed components and patch identifiers.

Workarounds

Enforce application allow-listing through MDM to block sideloaded or untrusted apps that could deliver a local exploit.
Disable developer options and USB debugging on managed devices to reduce the local attack surface.
For high-risk users, consider issuing replacement devices already shipping with the June 2026 or later patch level until in-place updates are completed.

bash

# Verify Android Security Patch Level on a managed device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-06-01 or later