Is CVE-2026-57554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57554 being exploited in the wild.

How severe is CVE-2026-57554?

High severity, with a CVSS score of 7.8, published 6 October 2026.

Is there a fix for CVE-2026-57554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57554 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-57554?

Check whether you run Qualcomm FastRPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57554: Qualcomm FastRPC memory corruption in performance counter access

CVE-2026-57554 · Severity: high · CVSS 7.8 · Published 2026-10-06

Qualcomm's FastRPC framework, which enables inter-process communication on mobile and embedded devices, contains a memory corruption vulnerability when multiple threads simultaneously access shared performance counter data. An attacker with local access could exploit this to crash the system, corrupt data, or potentially execute arbitrary code, affecting the stability and security of devices using affected Qualcomm components.

Vendors: Qualcomm.

Quick answers

Is CVE-2026-57554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57554 being exploited in the wild.
How severe is CVE-2026-57554?: High severity, with a CVSS score of 7.8, published 6 October 2026.
Which products and versions are affected?: Qualcomm FastRPC <UNKNOWN>.
Is there a fix for CVE-2026-57554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57554 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-57554?: Check whether you run Qualcomm FastRPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in FastRPC's performance counter implementation where asynchronous threads access shared data structures without proper synchronization. The vulnerability occurs during concurrent FastRPC invocations when multiple threads update or read performance metrics simultaneously, leading to heap or stack corruption. This requires local code execution capability but no special privileges to trigger.

Affected products

Qualcomm FastRPC <UNKNOWN>

Timeline

2026-10-06: disclosed
2026-10-06: advisory: Qualcomm October 2026 Security Bulletin

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.