Introduction
A classic buffer overflow in Qualcomm's Secure Processing Unit, the hardware root of trust for Android's StrongBox Keymaster, puts hardware-backed cryptographic keys at risk across more than 50 chipsets powering flagship smartphones, AR/VR headsets, and IoT devices. CVE-2026-25277 has a CVSS score of 8.8 with a Scope Changed designation. That means successful exploitation of this isolated secure element can break its security boundary and compromise the broader Android system, which undermines the isolation guarantee the SPU was designed to provide.
The timing matters. Three months ago, a similar Qualcomm firmware buffer overflow (CVE-2026-21385) was confirmed exploited in targeted Android attacks. That fits a clear pattern of real-world interest from sophisticated threat actors in this class of vulnerability.
Technical Information
Root Cause: CWE-120 in the Secure Processor
CVE-2026-25277 is classified under CWE-120: Buffer Copy Without Checking Size of Input. The Qualcomm June 2026 Security Bulletin titles it "Buffer Copy Without Checking Size of Input in Secure Processor" and describes the flaw as "Memory corruption while using Strongbox due to buffer overflow." The root cause is simple. The SPU's StrongBox firmware copies data into a buffer without verifying that the input size does not exceed the buffer's allocated capacity. Oversized input overwrites adjacent memory and corrupts it.
Understanding the Attack Surface: Qualcomm SPU and StrongBox
The Qualcomm Secure Processing Unit (SPU) is an on-die secure element integrated directly into Snapdragon SoCs. It runs as a physically isolated execution environment, separate from the main application processor, and is designed to run High Assurance Applications that previously required external discrete security chips. The SPU is the hardware foundation for Android's StrongBox Keymaster implementation, a hardware-backed keystore that manages:
- Generation, storage, and use of cryptographic keys
- Biometric authentication credentials
- File-based encryption keys
- Payment credential protection
The SPU has been certified to Common Criteria EAL-4+ (approved by the German Federal Office for Information Security) and submitted to the NIST Cryptographic Module Validation Program under FIPS 140-2. Formal evaluation assesses the rigor of design and process. It does not prove the absence of every possible implementation flaw, and a classic buffer overflow in this certified component shows the difference.
CVSS Vector Breakdown
The full CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:
| CVSS Metric | Value | Interpretation |
|---|---|---|
| Attack Vector (AV) | Local | Attacker needs local access to the device |
| Attack Complexity (AC) | Low | No special conditions required for exploitation |
| Privileges Required (PR) | Low | A standard unprivileged app is sufficient |
| User Interaction (UI) | None | No user action needed |
| Scope (S) | Changed | Impact crosses the SPU isolation boundary into the Android OS |
| Confidentiality (C) | High | Complete information disclosure possible |
| Integrity (I) | High | Complete system integrity compromise possible |
| Availability (A) | High | Complete denial of service possible |
Scope Changed is the metric with the most consequence here. The SPU exists to maintain a hardware isolation boundary, and a vulnerability that crosses that boundary inverts the security model. Instead of protecting secrets from a compromised OS, the SPU itself becomes the path through which the OS is further compromised.
Exploitation Flow
From the available technical data, a plausible exploitation chain would look like this:
-
An attacker gets low-privilege local access on the target device, for example through a malicious application installed via social engineering or a supply chain compromise.
-
The malicious application sends crafted input to the StrongBox Keymaster interface that exceeds the expected buffer size. The specific API call or ioctl that triggers the overflow has not been publicly disclosed.
-
Because the SPU firmware does not validate the input size before copying (CWE-120), the overflow corrupts adjacent memory within the SPU.
-
Given the Scope Changed impact rating, the attacker can use the memory corruption to escape the SPU's isolation boundary. From there, the attacker could potentially extract confidential key material, modify system integrity, or cause denial-of-service conditions.
No proof-of-concept exploit code has been publicly disclosed. Several technical details remain unknown, including the specific buffer size and overflow boundary, whether the overflow is stack-based or heap-based within the SPU, and the precise firmware versions where the fix was applied.
Sibling Vulnerability: CVE-2026-25276
The same bulletin disclosed CVE-2026-25276, a sibling vulnerability in StrongBox that affects the exact same chipset list. CVE-2026-25276 is an array index validation issue (CWE-129: Improper Validation of Array Index), while CVE-2026-25277 is a buffer copy without bounds checking. Both carry CVSS 3.1 scores of 8.8 and identical vectors, which suggests they were fixed together in a coordinated StrongBox firmware update targeting multiple related memory-safety issues in the same code path.
Patch Information
CVE-2026-25277 has been patched, but the fix lives entirely within Qualcomm's closed-source firmware. There is no publicly accessible source-code commit or diff to inspect. Because StrongBox operates at the hardware trust boundary, the corrective code is proprietary and distributed only through Qualcomm's OEM patch channel.
According to the Qualcomm June 2026 Security Bulletin, OEMs were notified on 2026-04-06, nearly two months before public disclosure. The bulletin states that patches are "being actively shared with OEMs, who have been notified and strongly recommended to deploy those patches on released devices as soon as possible."
On the Android side, the Android Security Bulletin for June 2026 lists CVE-2026-25277 in the "Qualcomm closed-source components" section with a severity rating of Critical. It is tracked as Android bug A-500022443. The bug carries an asterisk, which means the issue is not publicly available and the update is generally contained in the latest binary drivers for Pixel devices on the Google Developer site. Devices running security patch level 2026-06-05 or later include the fix.
The Secure Processor firmware ships as a signed binary blob, so end users cannot apply the fix themselves. It has to arrive through an OEM firmware or Android system update that incorporates the corrected Qualcomm binary. For Pixel devices, that means the June 2026 factory image or OTA. For other Android vendors, the timeline depends on each manufacturer's integration and release cycle.
Key patching actions for organizations:
| Priority | Action | Rationale |
|---|---|---|
| Immediate | Check with device OEMs for available patches for all affected Qualcomm-based devices | Qualcomm has provided patches to OEMs but deployment timelines vary by manufacturer |
| Immediate | Prioritize patching of devices handling sensitive data (payment, authentication, healthcare) | StrongBox protects cryptographic keys; compromise of these devices has the highest impact |
| Short-term | Restrict installation of untrusted applications on affected devices in enterprise environments | Low-privilege local access is required; reducing app installation reduces attack surface |
| Ongoing | Monitor Qualcomm security bulletins and CISA KEV updates for emerging threat intelligence | Active exploitation status may change |
No workaround or configuration change was identified that fixes the root cause without patching. The vulnerability is in SPU firmware, which cannot be disabled without breaking core Android security functions, including Keymaster, Gatekeeper, biometric authentication, and file-based encryption.
Affected Systems and Versions
The vulnerability affects over 50 Qualcomm chipsets and platforms. The Qualcomm June 2026 Security Bulletin names these affected platforms:
Flagship Mobile Platforms:
- Snapdragon 8 Elite
- Snapdragon 8 Elite Gen 5
- Snapdragon 8 Gen 2
- Snapdragon 8+ Gen 2
- Snapdragon 8 Gen 3
Connectivity Components:
- FastConnect 6700
- FastConnect 6800
- FastConnect 6900
- FastConnect 7800
Audio Codecs:
- WCD93xx series
- WSA88xx series
The affected platforms span flagship smartphones, AR/VR headsets, and IoT devices. The flaw is in the Secure Processor component (the StrongBox subsystem), which is proprietary closed-source firmware.
Android Patch Level: Devices running security patch level 2026-06-05 or later include the fix. The Android Security Bulletin tracks this as bug A-500022443 under Qualcomm closed-source components.
Vendor Security History
Qualcomm has a mixed but transparent security track record. The company publishes monthly security bulletins and maintains a dedicated product security team. The June 2026 bulletin alone addresses 24 CVEs across Critical, High, and Moderate severity levels.
Qualcomm components have also been the target of confirmed in-the-wild exploitation:
-
CVE-2026-21385 (March 2026): A buffer overflow in Qualcomm SM7675P firmware was confirmed exploited in targeted Android attacks. Google's Android Security Bulletin warned of indications it "may be under limited, targeted exploitation." That same month, Google's security update contained the highest number of Android vulnerabilities patched in a single month since April 2018.
-
CVE-2024-43047 (2024): A Qualcomm DSP vulnerability flagged as possibly exploited by Google and Amnesty International.
-
CVE-2025-48651 (April 2026): A separate StrongBox vulnerability patched at high severity, affecting StrongBox implementations from Google, NXP, STMicroelectronics, and Thales. StrongBox vulnerabilities are not unique to Qualcomm.
Qualcomm's internal discovery of CVE-2026-25277 and the two-month lead time it gave OEMs before public disclosure reflect responsible vulnerability management. The SPU's EAL-4+ certification and NIST CMVP validation show investment in formal security assurance. A CWE-120 buffer overflow in that certified component also shows the gap between certification and implementation correctness.
References
- NVD: CVE-2026-25277
- CVE Record: CVE-2026-25277
- Qualcomm June 2026 Security Bulletin
- Android Security Bulletin: June 2026
- Qualcomm Snapdragon 855 Common Criteria EAL-4+ Certification Announcement
- Severe StrongBox Vulnerability Patched in Android (SecurityWeek)
- CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Attacks (SOCPrime)
- Google Addresses Actively Exploited Qualcomm Zero-Day (CyberScoop)
- Qualcomm Alerted to Possible Zero-Day Exploited in Targeted Attacks (SecurityWeek)
- CISA Known Exploited Vulnerabilities Catalog
- More CVEs, Same Playbook: 2026 Vulnerability Exploitation (Proofpoint)
- Qualcomm SPU FIPS 140-2 Security Policy (NIST CMVP)
- Qualcomm Security Advisory: March 2026 Monthly Rollup (Canadian Centre for Cyber Security)
