PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24073 Qualcomm, Inc. CVE debrief

A memory corruption vulnerability exists when processing decode statistics due to insufficient validation of offset against structure size. This issue has a CVSS score of 7.8 and is classified as HIGH severity. The CVE record was published on 2026-09-17T05:16:59.760Z and was last modified on 2026-09-18T19:06:08.407Z. Defenders responsible for systems using Qualcomm products should assess the potential impact of this vulnerability on their organization's assets and prioritize verification and patching efforts accordingly. The vulnerability can lead to memory corruption, potentially allowing attackers to execute arbitrary code or cause a denial of service.

Vendor
Qualcomm, Inc.
Product
Snapdragon
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-09-18
Advisory published
2026-09-17
Advisory updated
2026-09-18

Who should care

Defenders responsible for systems using Qualcomm products should assess the potential impact of this vulnerability on their organization's assets and prioritize verification and patching efforts accordingly.

Why it matters

This HIGH-severity memory corruption vulnerability in Qualcomm products requires verification of presence, assessment of potential impact, and prioritization of patching efforts by defenders responsible for affected systems.

  • Verification of vulnerability presence in systems
  • Assessment of potential impact on organization assets
  • Patching or updating vulnerable systems

Technical summary

The vulnerability exists when processing decode statistics due to insufficient validation of offset against structure size, potentially leading to memory corruption. This can occur when the offset is larger than the structure size, causing the system to access memory outside the bounds of the structure. As a result, an attacker could potentially execute arbitrary code or cause a denial of service. The CVSS score of 7.8 indicates a high severity vulnerability that requires immediate attention.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially those using Qualcomm products, and assess the potential impact on their organization's assets.

Recommended defensive actions

  • Verify the presence of this vulnerability in your systems, especially those using Qualcomm products
  • Assess the potential impact on your organization's assets
  • Check for any available patches or updates from the vendor

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but the scope of affected products and versions is not explicitly stated, requiring further verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24073 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24073

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24073 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24073

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.