SB2026020406 - Multiple vulnerabilities in Qualcomm chipsets (February 2026)
Published: February 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Use After Free (CVE-ID: CVE-2025-47358)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Secure Processor. A local application can execute arbitrary code.
2) Use After Free (CVE-ID: CVE-2025-47359)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Secure Processor. A local application can execute arbitrary code.
3) Integer overflow (CVE-ID: CVE-2025-47363)
The vulnerability allows a local attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive. A local attacker can execute arbitrary code.
4) Integer overflow (CVE-ID: CVE-2025-47364)
The vulnerability allows a local attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive. A local attacker can execute arbitrary code.
5) Exposed Dangerous Method or Function (CVE-ID: CVE-2025-47366)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in HLOS. A local application can read and manipulate data.
6) Buffer overflow (CVE-ID: CVE-2025-47399)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
7) Buffer over-read (CVE-ID: CVE-2025-47402)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
8) Missing release of memory after effective lifetime (CVE-ID: CVE-2025-47397)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.
9) Use After Free (CVE-ID: CVE-2025-47398)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.