CVE-2026-25258: Out-of-bounds Read in DSP Service

Synopsis

An out-of-bounds read vulnerability in the Qualcomm Snapdragon DSP service allows a local attacker with low-privilege access to corrupt memory through malformed IOCTL calls for escape operations. The attacker must already have a shell or process running on the affected device; no network access or user interaction is required. Successful exploitation gives the attacker full read, write, and execution control over the affected component, enabling data theft, data tampering, and potential code execution. No fix version has been published yet; HarborGuard tracks the Qualcomm advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or root credentials to trigger the vulnerable IOCTL path.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the vulnerable IOCTL calls entirely from their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads arbitrary memory from the DSP service process, exposing sensitive data such as cryptographic keys or session state held in that process.
• The attacker writes to memory outside the intended buffer, corrupting data structures and potentially overwriting security-relevant state in the DSP service.
• Full confidentiality, integrity, and availability impact is confirmed by the CVSS tokens (C:H/I:H/A:H), meaning the attacker can crash the DSP service entirely in addition to reading and modifying its data.
• Privilege escalation within the DSP service context is feasible given arbitrary memory write capability, potentially affecting other processes sharing that memory region.