SB20260415124 - Multiple vulnerabilities in Qualcomm chipsets (April 2026)
Published: April 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Buffer over-read (CVE-ID: CVE-2026-21373)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
2) Buffer over-read (CVE-ID: CVE-2026-21381)
The vulnerability allows a remote privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote privileged application can execute arbitrary code.
3) Use After Free (CVE-ID: CVE-2026-21380)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Service. A local application can execute arbitrary code.
4) Buffer over-read (CVE-ID: CVE-2026-21378)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
5) Buffer over-read (CVE-ID: CVE-2026-21376)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
6) Buffer over-read (CVE-ID: CVE-2026-21375)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
7) Buffer over-read (CVE-ID: CVE-2026-21374)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
8) Heap-based Buffer Overflow (CVE-ID: CVE-2026-21372)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Power Management IC. A local application can execute arbitrary code.
9) Buffer overflow (CVE-ID: CVE-2026-21382)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Power Management IC. A local application can execute arbitrary code.
10) Buffer over-read (CVE-ID: CVE-2026-21371)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WinBlast Driver. A local application can execute arbitrary code.
11) Buffer over-read (CVE-ID: CVE-2026-21367)
The vulnerability allows a remote privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote privileged application can execute arbitrary code.
12) Buffer over-read (CVE-ID: CVE-2025-47400)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Computer Vision. A local application can read and manipulate data.
13) Buffer overflow (CVE-ID: CVE-2025-47389)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Platform. A local application can execute arbitrary code.
14) Integer overflow (CVE-ID: CVE-2025-47392)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in GPS. A remote attacker can execute arbitrary code.
15) Stack-based buffer overflow (CVE-ID: CVE-2025-47391)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera Driver. A local application can execute arbitrary code.
16) Buffer over-read (CVE-ID: CVE-2025-47390)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
17) Use After Free (CVE-ID: CVE-2025-47374)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera Driver. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.