# CVE-2026-24089: Qualcomm Snapdragon memory corruption in fastboot command processing

Source: https://junglewise.ai/threats/cve-2026-24089-qualcomm-snapdragon-memory-corruption-in-fastboot-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-24089 · Severity: high · CVSS 7.2 · Published 2026-06-01

A security vulnerability exists in the bootloader software of certain Qualcomm-based mobile devices. An attacker with physical access to the device and high-level privileges could use specially crafted commands to cause memory corruption. This could potentially allow the attacker to bypass security protections, gain unauthorized access to data, or disable the device.

Technologies: [Qualcomm Snapdragon Mobile](https://junglewise.ai/threats/technologies/snapdragon-mobile). Vendors: [Qualcomm](https://junglewise.ai/threats/vendors/qualcomm).

## Quick answers

**Is CVE-2026-24089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24089 being exploited in the wild.

**How severe is CVE-2026-24089?** High severity, with a CVSS score of 7.2, published 1 June 2026.

**Which products and versions are affected?** Qualcomm Snapdragon Mobile.

**Is there a fix for CVE-2026-24089?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24089 attacked?** It is attacked with physical access, in device firmware.

**Am I affected by CVE-2026-24089?** Check whether you run Qualcomm Snapdragon Mobile. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory corruption vulnerability exists in the Qualcomm fastboot implementation due to improper validation of syntactic correctness of input (CWE-1286). The flaw is triggered when the bootloader processes malformed fastboot commands. An attacker requires physical access to the device (AV:P) and high privileges (PR:H) to execute the exploit. Successful exploitation can lead to a scope change (S:C), potentially allowing for arbitrary code execution at the bootloader level, impacting the confidentiality, integrity, and availability of the entire system. Fixes are typically distributed via OEM security updates.

## Affected products

- Qualcomm Snapdragon Mobile

## Timeline

- 2026-06-01: disclosed: Initial publication by Qualcomm and NVD

## References

- [https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html](https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html)

## Related threats

- [Qualcomm Snapdragon memory corruption in HT40 channel switching](https://junglewise.ai/threats/cve-2026-25268-qualcomm-snapdragon-memory-corruption-in-ht40-channel-switching)
- [Qualcomm Snapdragon memory corruption via TOCTOU in shared buffers](https://junglewise.ai/threats/cve-2026-25260-qualcomm-snapdragon-memory-corruption-via-toctou-in-shared)
- [Qualcomm Chipset memory corruption in IOCTL escape operations](https://junglewise.ai/threats/cve-2026-25259-qualcomm-chipset-memory-corruption-in-ioctl-escape-operations)
- [Qualcomm Snapdragon memory corruption in IOCTL escape operations](https://junglewise.ai/threats/cve-2026-25258-qualcomm-snapdragon-memory-corruption-in-ioctl-escape-operations)
- [Qualcomm Snapdragon memory corruption in fastboot display mode command](https://junglewise.ai/threats/cve-2026-24092-qualcomm-snapdragon-memory-corruption-in-fastboot-display-mode)