CVE-2026-24088: Missing Authentication for Critical Function in Boot

Synopsis

A cryptographic verification failure in Qualcomm Snapdragon's boot partition processing allows an attacker with local privileged access to bypass integrity checks and write a customized bootloader to the device. The vulnerability is reachable locally and requires a high-privilege account, but does not require any user interaction. Successful exploitation grants full control over the boot chain, enabling persistent firmware-level compromise, disclosure of all data on the device, and the ability to tamper with or destroy stored data. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available as soon as Qualcomm publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  A high-privilege (admin-level) account on the target system is needed to reach the vulnerable boot partition processing function.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability without involving any other party.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker holds the required privilege level; no race conditions or special environmental factors apply.

Blast Radius

• Reads all data stored on the device, including credentials, keys, and application data, because a compromised bootloader runs before OS-level protections are established.
• Writes arbitrary code into the bootloader, enabling persistent implants that survive factory resets and OS reinstallation.
• Crashes or permanently disables the device by corrupting the boot partition beyond recovery.
• Bypasses code-signing and secure-boot guarantees for every subsequent OS and firmware component loaded after the tampered bootloader.