CVE-2026-24080: Qualcomm fingerprint TA memory corruption in request parameter handling
CVE-2026-24080 · Severity: high · CVSS 7.8 · Published 2026-08-04
Qualcomm's fingerprint trusted application (TA) contains a memory corruption vulnerability when processing malformed request parameters. An attacker able to send crafted requests to the fingerprint service could trigger memory corruption, potentially leading to service crashes or unauthorized access to sensitive biometric data.
No. Junglewise Threat Intelligence has no report of CVE-2026-24080 being exploited in the wild.
How severe is CVE-2026-24080?
High severity, with a CVSS score of 7.8, published 4 August 2026.
Which products and versions are affected?
Qualcomm fingerprint TA <UNKNOWN>.
Is there a fix for CVE-2026-24080?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24080 attacked?
It is attacked with local access or from the adjacent network.
Am I affected by CVE-2026-24080?
Check whether you run Qualcomm Cologne, Qualcomm Cologne Firmware, Qualcomm Fastconnect 6700 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A memory corruption vulnerability exists in Qualcomm's fingerprint trusted application when handling malformed request parameters. The vulnerability stems from insufficient validation of input parameters before processing them in memory operations. The fingerprint TA is a sensitive component handling biometric authentication; exploitation could occur from a local or adjacent network context with access to the vulnerable service. An attacker can cause memory corruption leading to denial of service or potential privilege escalation within the trusted execution environment. Patches are expected to be available through Qualcomm's security bulletins.