CVE-2026-24076

Description

Memory Corruption when processing registry values with incorrect types using a direct query method.

Overview

State: PUBLISHED
Assigner (CNA): qualcomm
CVSS severity: MEDIUM
CVSS score: 6.7 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Effective score: 6.7 / 10 MEDIUM source: CNA overview
CWE(s): CWE-120
Reserved: 2026-01-21
Published: 2026-08-04 15:07 UTC
Last updated: 2026-08-05 03:56 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24076.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-08-04 16:16:22 UTC
NVD last modified: 2026-08-05 05:16:57 UTC
NVD CVSS v3.1: 6.7 / 10 MEDIUM source: product-security@qualcomm.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 0.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0011 (probability of exploitation in next 30 days)
EPSS percentile: 1.78% vs all CVEs — higher = more likely to be exploited, as of 2026-08-05

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52729
Assigner: qualcomm
Published: Aug 4, 2026, 3:07:13 PM
Updated: Aug 5, 2026, 3:56:31 AM
EUVD base score (CVSS 3.1): 6.7 / 10
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Vendors: Qualcomm, Inc.
Products: Snapdragon (WSA8845)

Snapdragon (X2000090)

Snapdragon (Snapdragon 8cx Compute Platform)

Snapdragon (XG101032)

Snapdragon (Snapdragon 8c Compute Platform "Poipu Lite")

Snapdragon (Snapdragon 8cx Compute Platform "Poipu Pro")

Snapdragon (QCA2066)

Snapdragon (QCA2062)

Snapdragon (FastConnect 6800)

Snapdragon (WSA8830)

Snapdragon (Qualcomm Video Collaboration VC3 Platform)

Snapdragon (X2000086)

Snapdragon (WCD9380)

Snapdragon (WCD9385)

Snapdragon (WSA8840)

Snapdragon (WCD9378C)

Snapdragon (WCD9375)

Snapdragon (Snapdragon 7c Compute Platform)

Snapdragon (X2000077)

Snapdragon (FastConnect 7800)

Snapdragon (WCD9370)

Snapdragon (WCD9340)

Snapdragon (AQT1000)

Snapdragon (XG101039)

Snapdragon (Snapdragon 7c+ Gen 3 Compute)

Snapdragon (Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite")

Snapdragon (FastConnect 6900)

Snapdragon (X2000092)

Snapdragon (SC8380XP)

Snapdragon (QCA2064)

Snapdragon (QCA0000)

Snapdragon (Snapdragon 8cx Gen 3 Compute Platform)

Snapdragon (Snapdragon 8cx Gen 2 5G Compute Platform)

Snapdragon (SM6250)

Snapdragon (QCM5430)

Snapdragon (QCM6490)

Snapdragon (WCD9341)

Snapdragon (X2000094)

Snapdragon (FastConnect 6200)

Snapdragon (QCA6391)

Snapdragon (WSA8810)

Snapdragon (Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro")

Snapdragon (XG101002)

Snapdragon (QCA2065)

Snapdragon (WSA8815)

Snapdragon (WSA8845H)

Snapdragon (Cologne)

Snapdragon (QCA6420)

Snapdragon (Snapdragon 7c Gen 2 Compute Platform "Rennell Pro")

Snapdragon (FastConnect 6700)

Snapdragon (QCA6430)

Snapdragon (WSA8835)
Aliases: GHSA-x4xm-vp2r-mjc3

ENISA description: Memory Corruption when processing registry values with incorrect types using a direct query method.

EUVD references (1)

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html

Affected products (1)

Vendor	Product	Versions	Platforms
Qualcomm, Inc.	Snapdragon	`AQT1000` (affected), `Cologne` (affected), `FastConnect 6200` (affected), `FastConnect 6700` (affected), `FastConnect 6800` (affected), `FastConnect 6900` (affected), `FastConnect 7800` (affected), `QCA0000` (affected), `QCA2062` (affected), `QCA2064` (affected), `QCA2065` (affected), `QCA2066` (affected), `QCA6391` (affected), `QCA6420` (affected), `QCA6430` (affected), `QCM5430` (affected), `QCM6490` (affected), `Qualcomm Video Collaboration VC3 Platform` (affected), `SC8380XP` (affected), `SM6250` (affected), `Snapdragon 7c Compute Platform` (affected), `Snapdragon 7c Gen 2 Compute Platform "Rennell Pro"` (affected), `Snapdragon 7c+ Gen 3 Compute` (affected), `Snapdragon 8c Compute Platform "Poipu Lite"` (affected), `Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"` (affected), `Snapdragon 8cx Compute Platform` (affected), `Snapdragon 8cx Compute Platform "Poipu Pro"` (affected), `Snapdragon 8cx Gen 2 5G Compute Platform` (affected), `Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro"` (affected), `Snapdragon 8cx Gen 3 Compute Platform` (affected), `WCD9340` (affected), `WCD9341` (affected), `WCD9370` (affected), `WCD9375` (affected), `WCD9378C` (affected), `WCD9380` (affected), `WCD9385` (affected), `WSA8810` (affected), `WSA8815` (affected), `WSA8830` (affected), `WSA8835` (affected), `WSA8840` (affected), `WSA8845` (affected), `WSA8845H` (affected), `X2000077` (affected), `X2000086` (affected), `X2000090` (affected), `X2000092` (affected), `X2000094` (affected), `XG101002` (affected), `XG101032` (affected), `XG101039` (affected)	Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html product-security@qualcomm.com

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-24076.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T03:56:31.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Snapdragon Compute",
            "Snapdragon Consumer Electronics Connectivity",
            "Snapdragon Industrial IOT"
          ],
          "product": "Snapdragon",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "AQT1000"
            },
            {
              "status": "affected",
              "version": "Cologne"
            },
            {
              "status": "affected",
              "version": "FastConnect 6200"
            },
            {
              "status": "affected",
              "version": "FastConnect 6700"
            },
            {
              "status": "affected",
              "version": "FastConnect 6800"
            },
            {
              "status": "affected",
              "version": "FastConnect 6900"
            },
            {
              "status": "affected",
              "version": "FastConnect 7800"
            },
            {
              "status": "affected",
              "version": "QCA0000"
            },
            {
              "status": "affected",
              "version": "QCA2062"
            },
            {
              "status": "affected",
              "version": "QCA2064"
            },
            {
              "status": "affected",
              "version": "QCA2065"
            },
            {
              "status": "affected",
              "version": "QCA2066"
            },
            {
              "status": "affected",
              "version": "QCA6391"
            },
            {
              "status": "affected",
              "version": "QCA6420"
            },
            {
              "status": "affected",
              "version": "QCA6430"
            },
            {
              "status": "affected",
              "version": "QCM5430"
            },
            {
              "status": "affected",
              "version": "QCM6490"
            },
            {
              "status": "affected",
              "version": "Qualcomm Video Collaboration VC3 Platform"
            },
            {
              "status": "affected",
              "version": "SC8380XP"
            },
            {
              "status": "affected",
              "version": "SM6250"
            },
            {
              "status": "affected",
              "version": "Snapdragon 7c Compute Platform"
            },
            {
              "status": "affected",
              "version": "Snapdragon 7c Gen 2 Compute Platform \"Rennell Pro\""
            },
            {
              "status": "affected",
              "version": "Snapdragon 7c+ Gen 3 Compute"
            },
            {
              "status": "affected",
              "version": "Snapdragon 8c Compute Platform \"Poipu Lite\""
            },
            {
              "status": "affected",
              "version": "Snapdragon 8c Compute Platform (SC8180XP-AD) \"Poipu Lite\""
            },
            {
              "status": "affected",
              "version": "Snapdragon 8cx Compute Platform"
            },
            {
              "status": "affected",
              "version": "Snapdragon 8cx Compute Platform \"Poipu Pro\""
            },
            {
              "status": "affected",
              "version": "Snapdragon 8cx Gen 2 5G Compute Platform"
            },
            {
              "status": "affected",
              "version": "Snapdragon 8cx Gen 2 5G Compute Platform \"Poipu Pro\""
            },
            {
              "status": "affected",
              "version": "Snapdragon 8cx Gen 3 Compute Platform"
            },
            {
              "status": "affected",
              "version": "WCD9340"
            },
            {
              "status": "affected",
              "version": "WCD9341"
            },
            {
              "status": "affected",
              "version": "WCD9370"
            },
            {
              "status": "affected",
              "version": "WCD9375"
            },
            {
              "status": "affected",
              "version": "WCD9378C"
            },
            {
              "status": "affected",
              "version": "WCD9380"
            },
            {
              "status": "affected",
              "version": "WCD9385"
            },
            {
              "status": "affected",
              "version": "WSA8810"
            },
            {
              "status": "affected",
              "version": "WSA8815"
            },
            {
              "status": "affected",
              "version": "WSA8830"
            },
            {
              "status": "affected",
              "version": "WSA8835"
            },
            {
              "status": "affected",
              "version": "WSA8840"
            },
            {
              "status": "affected",
              "version": "WSA8845"
            },
            {
              "status": "affected",
              "version": "WSA8845H"
            },
            {
              "status": "affected",
              "version": "X2000077"
            },
            {
              "status": "affected",
              "version": "X2000086"
            },
            {
              "status": "affected",
              "version": "X2000090"
            },
            {
              "status": "affected",
              "version": "X2000092"
            },
            {
              "status": "affected",
              "version": "X2000094"
            },
            {
              "status": "affected",
              "version": "XG101002"
            },
            {
              "status": "affected",
              "version": "XG101032"
            },
            {
              "status": "affected",
              "version": "XG101039"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory Corruption when processing registry values with incorrect types using a direct query method."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy Without Checking Size of Input ('Classic Buffer Overflow')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T15:07:13.587Z",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html"
        }
      ],
      "title": "Buffer Copy Without Checking Size of Input in Bluetooth HOST"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2026-24076",
    "datePublished": "2026-08-04T15:07:13.587Z",
    "dateReserved": "2026-01-21T12:51:13.995Z",
    "dateUpdated": "2026-08-05T03:56:31.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}