Quick answers
- Is CVE-2026-24082 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-24082 being exploited in the wild.
- How severe is CVE-2026-24082?
- High severity, with a CVSS score of 7.8, published 4 May 2026.
- Which products and versions are affected?
- Qualcomm Qxm1096 Firmware -; Qualcomm Robotics Rb2 Firmware -.
- Is there a fix for CVE-2026-24082?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-24082 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-24082?
- Check whether you run Qualcomm Qxm1096 Firmware, Qualcomm Robotics Rb2 Firmware or Qualcomm Snapdragon Connectivity and Computing Platforms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a Use-After-Free (UAF) leading to memory corruption within Qualcomm's performance counter management logic. The flaw occurs when the system attempts to copy data from a memory source that has already been freed during a 'deselect' operation. A local attacker with low privileges could trigger this condition to corrupt kernel memory, potentially leading to local privilege escalation (LPE) or a denial-of-service (DoS) state. The issue is addressed in the Qualcomm May 2026 security bulletin.
Affected products
- Qualcomm Snapdragon Connectivity and Computing Platforms
Timeline
- 2026-05-04: advisory: Initial disclosure by Qualcomm and NVD