CVE-2026-25276: Improper Validation of Array Index in Secure Processor

Synopsis

An improper array index validation vulnerability (missing bounds check) in the Qualcomm Snapdragon Secure Processor (Strongbox) allows memory corruption from a local context. The flaw is reachable by a low-privilege local process with no user interaction required, as indicated by the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation gives an attacker full read, write, and availability impact across the security boundary, including the Strongbox trusted execution environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Qualcomm publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable Strongbox interface.

• AuthenticationRequired

  Any low-privilege local account or process is sufficient to trigger the missing bounds check; no elevated or admin credentials are needed.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can invoke the vulnerable code path directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race condition, memory layout arrangement, or other environmental prerequisite.

Blast Radius

• Reads protected cryptographic keys and secrets stored inside the Strongbox trusted execution environment.
• Writes arbitrary data into secure memory regions, allowing tampering with integrity-protected storage and attestation records.
• Crashes or destabilizes the Strongbox secure processor, disrupting hardware-backed key operations and breaking dependent security features on the device.
• Because the CVSS scope token is Changed (S:C), impact extends beyond the vulnerable component and can affect other system components that rely on Strongbox for trust anchoring.