CVE-2026-24090: Missing Authentication for Critical Function in HLOS

Synopsis

A missing-authentication vulnerability in the Qualcomm Snapdragon HLOS partition table processing component allows a local attacker with low privileges to tamper with the boot flow. The attacker needs only an existing low-privilege account on the host; no network access or victim interaction is required. Successful exploitation enables unauthorized modification of the device boot flow and full read access to sensitive on-device data. No upstream fix has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as Qualcomm releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege account on the host is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No user interaction of any kind is required; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• Reads sensitive on-device data, including data protected by partition-level access controls.
• Modifies partition table entries to redirect or corrupt the device boot flow.
• Persists unauthorized changes across reboots by altering the boot sequence before the OS loads.
• Potentially undermines secure boot guarantees, allowing unsigned or tampered firmware to execute.