CVE-2026-24088: Qualcomm Chipset cryptographic bypass in bootloader partition

CVE-2026-24088 · Severity: high · CVSS 8.2 · Published 2026-06-01

A security flaw in Qualcomm chipsets allows an attacker with high-level system privileges to bypass cryptographic protections during the boot process. By exploiting this issue, an attacker can replace the device's official startup software with a custom, unauthorized version. This could lead to a total compromise of the device's security, allowing persistent control that survives factory resets and the ability to bypass all operating system security measures.

Technologies: Qualcomm Snapdragon Mobile. Vendors: Qualcomm.

Quick answers

Is CVE-2026-24088 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24088 being exploited in the wild.
How severe is CVE-2026-24088?
High severity, with a CVSS score of 8.2, published 1 June 2026.
Which products and versions are affected?
Qualcomm Snapdragon Mobile.
Is there a fix for CVE-2026-24088?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24088 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-24088?
Check whether you run Qualcomm Snapdragon Mobile. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cryptographic vulnerability exists in the way Qualcomm firmware processes a specific storage partition, categorized as a missing authentication for a critical function (CWE-306). An attacker with local access and high privileges (such as root or administrative access) can exploit this flaw to gain unauthorized write access to protected partitions. This allows the attacker to bypass Secure Boot mechanisms and load a customized, unsigned, or malicious bootloader. The vulnerability has a high impact on confidentiality, integrity, and availability, and it involves a scope jump (S:C) because compromising the bootloader undermines the security of the entire operating system and hardware environment. Fixes are typically distributed via OEM security updates.

Affected products

  • Qualcomm Snapdragon Mobile

Timeline

  • 2026-06-01: disclosed
  • 2026-06-01: advisory: Published in Qualcomm June 2026 Security Bulletin

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.