CVE-2026-25277: Buffer Copy Without Checking Size of Input in Secure Processor

Synopsis

A stack-based buffer overflow in Qualcomm's Strongbox secure processor implementation affects Snapdragon 8 Gen 2, 8+ Gen 2, 8 Gen 3, and 8 Elite mobile platforms. An attacker with a low-privilege account on the host can trigger memory corruption locally, with no user interaction required. Successful exploitation gives the attacker full read, write, and availability impact across a changed security scope, meaning it can break out of the Strongbox trust boundary and affect resources the attacker does not normally control. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Qualcomm publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerability; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No action from another user or process on the system is necessary to trigger the overflow.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or other environmental factors need to align for the attack to succeed.

Blast Radius

• Reads secrets and cryptographic key material stored inside the Strongbox secure environment, bypassing the hardware trust boundary intended to protect them.
• Modifies data and code within the secure processor's memory space, allowing an attacker to tamper with security-critical operations such as key attestation or trusted application execution.
• Crashes or disrupts the Strongbox secure enclave, making hardware-backed key storage and related security services unavailable to the host.
• Because the CVSS scope is changed, impact extends beyond the originating process and can affect other isolated components sharing the Snapdragon security architecture.