{"id":"CVE-2026-25270","title":"Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.","summary":"Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"Qualcomm, Inc.","product":"Snapdragon","affected":["Snapdragon FastConnect 6700","Snapdragon FastConnect 6900","Snapdragon FastConnect 7800","Snapdragon Kalpeni","Snapdragon QCM6490","Snapdragon Qualcomm Dragonwing QCM4490","Snapdragon Qualcomm Video Collaboration VC3 Platform","Snapdragon SD865 5G","Snapdragon Snapdragon 8 Gen 1 Mobile Platform","Snapdragon Snapdragon XR2 5G Platform","Snapdragon Snapdragon XR2+ Gen 1 Platform","Snapdragon SW5100","Snapdragon SW5100P","Snapdragon SXR2230P","Snapdragon SXR2250P","Snapdragon WCD9370","Snapdragon WCD9375","Snapdragon WCD9378","Snapdragon WCD9380","Snapdragon WCD9385","Snapdragon WCN3950","Snapdragon WCN3980","Snapdragon WCN3988","Snapdragon WSA8810","Snapdragon WSA8815","Snapdragon WSA8830","Snapdragon WSA8832","Snapdragon WSA8835","Snapdragon WSA8840","Snapdragon WSA8845","Snapdragon WSA8845H","Snapdragon X1E80100"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T07:16:57.367","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25270","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","label":"product-security@qualcomm.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-06T07:49:23.039Z","slug":"CVE-2026-25270","body":"## Overview\n\nMemory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}