CVE-2026-24085: Stack-based Buffer Overflow in Display

Synopsis

A stack-based buffer overflow affects Qualcomm Snapdragon display processing, triggered when handling display command line information due to improper variable initialization. The CVSS vector indicates physical access is required along with a privileged account, meaning an attacker must be physically present at the device and authenticated with admin-level credentials. Successful exploitation gives the attacker full read, write, and crash capabilities over the affected component. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as Qualcomm ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  Physical proximity to the device is required; the attacker must have hands-on access rather than reaching the target over a network.

• AuthenticationRequired

  A privileged (admin-level) account is required before the attacker can trigger the vulnerable display command processing path.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the overflow directly once physical access and credentials are in place.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads arbitrary data from the affected display subsystem, including sensitive in-memory state.
• Writes to memory regions in the display component, enabling tampering with display processing logic or persisted configuration.
• Crashes the affected display service, causing a denial of service on the device.
• Because the scope token is Changed, impact can extend beyond the vulnerable component into other system components sharing the same execution context.