Quick answers
- Is CVE-2026-24073 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-24073 being exploited in the wild.
- How severe is CVE-2026-24073?
- High severity, with a CVSS score of 7.8, published 17 September 2026.
- Which products and versions are affected?
- Qualcomm <UNKNOWN>.
- Is there a fix for CVE-2026-24073?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-24073 attacked?
- It is in device firmware.
- Am I affected by CVE-2026-24073?
- Check whether you run Qualcomm Cologne, Qualcomm Cologne Firmware, Qualcomm Fastconnect 6900 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a memory corruption flaw in decode statistics processing that results from inadequate validation of offset values against structure size limits. The root cause is a bounds-checking failure that allows an offset parameter to exceed valid memory boundaries within a target structure. Attack preconditions depend on how the vulnerable function is invoked, but exploitation typically requires the ability to control or influence the offset value passed to the decode statistics processor. An attacker with capability to trigger decode operations with malicious offset values can corrupt adjacent memory regions, leading to denial of service or potential code execution. Qualcomm has released security bulletins addressing this issue.
Affected products
- Qualcomm <UNKNOWN>
Timeline
- 2026-09-17: disclosed