CVE-2026-24075
HIGHDescription
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
Is your site exposed to CVE-2026-24075?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| qualcomm | wsa8845h_firmware |
| qualcomm | wsa8845h |
| qualcomm | aqt1000_firmware |
| qualcomm | aqt1000 |
| qualcomm | cologne_firmware |
| qualcomm | cologne |
| qualcomm | fastconnect_6200_firmware |
| qualcomm | fastconnect_6200 |
| qualcomm | fastconnect_6700_firmware |
| qualcomm | fastconnect_6700 |
| qualcomm | fastconnect_6800_firmware |
| qualcomm | fastconnect_6800 |
| qualcomm | fastconnect_6900_firmware |
| qualcomm | fastconnect_6900 |
| qualcomm | fastconnect_7800_firmware |
| qualcomm | fastconnect_7800 |
| qualcomm | iqx5121_firmware |
| qualcomm | iqx5121 |
| qualcomm | iqx7181_firmware |
| qualcomm | iqx7181 |
| qualcomm | qca0000_firmware |
| qualcomm | qca0000 |
| qualcomm | qca6391_firmware |
| qualcomm | qca6391 |
| qualcomm | qca6420_firmware |
| qualcomm | qca6420 |
| qualcomm | qca6430_firmware |
| qualcomm | qca6430 |
| qualcomm | qcm5430_firmware |
| qualcomm | qcm5430 |
| qualcomm | qcm6490_firmware |
| qualcomm | qcm6490 |
| qualcomm | video_collaboration_vc3_platform_firmware |
| qualcomm | video_collaboration_vc3_platform |
| qualcomm | sc8380xp_firmware |
| qualcomm | sc8380xp |
| qualcomm | sm6250_firmware |
| qualcomm | sm6250 |
| qualcomm | snapdragon_7c_compute_platform_firmware |
| qualcomm | snapdragon_7c_compute_platform |
| qualcomm | snapdragon_7c_gen_2_compute_platform_firmware |
| qualcomm | snapdragon_7c_gen_2_compute_platform |
| qualcomm | snapdragon_7c\+_gen_3_compute_firmware |
| qualcomm | snapdragon_7c\+_gen_3_compute |
| qualcomm | snapdragon_8c_compute_platform_firmware |
| qualcomm | snapdragon_8c_compute_platform |
| qualcomm | snapdragon_8c_compute_platform_\(sc8180xp-ad\)_firmware |
| qualcomm | snapdragon_8c_compute_platform_\(sc8180xp-ad\) |
| qualcomm | snapdragon_8cx_compute_platform_firmware |
| qualcomm | snapdragon_8cx_compute_platform |
| qualcomm | snapdragon_8cx_compute_platform_\"poipu_pro\"_firmware |
| qualcomm | snapdragon_8cx_compute_platform_\"poipu_pro\" |
| qualcomm | snapdragon_8cx_gen_2_5g_compute_platform_firmware |
| qualcomm | snapdragon_8cx_gen_2_5g_compute_platform |
| qualcomm | snapdragon_8cx_gen_2_5g_compute_platform_\"poipu_pro\"_firmware |
| qualcomm | snapdragon_8cx_gen_2_5g_compute_platform_\"poipu_pro\" |
| qualcomm | snapdragon_8cx_gen_3_compute_platform_firmware |
| qualcomm | snapdragon_8cx_gen_3_compute_platform |
| qualcomm | snapdragon_x2_elite_firmware |
| qualcomm | snapdragon_x2_elite |
| qualcomm | wcd9340_firmware |
| qualcomm | wcd9340 |
| qualcomm | wcd9341_firmware |
| qualcomm | wcd9341 |
| qualcomm | wcd9370_firmware |
| qualcomm | wcd9370 |
| qualcomm | wcd9375_firmware |
| qualcomm | wcd9375 |
| qualcomm | wcd9378c_firmware |
| qualcomm | wcd9378c |
| qualcomm | wcd9380_firmware |
| qualcomm | wcd9380 |
| qualcomm | wcd9385_firmware |
| qualcomm | wcd9385 |
| qualcomm | wsa8810_firmware |
| qualcomm | wsa8810 |
| qualcomm | wsa8815_firmware |
| qualcomm | wsa8815 |
| qualcomm | wsa8830_firmware |
| qualcomm | wsa8830 |
| qualcomm | wsa8835_firmware |
| qualcomm | wsa8835 |
| qualcomm | wsa8840_firmware |
| qualcomm | wsa8840 |
| qualcomm | wsa8845_firmware |
| qualcomm | wsa8845 |
References
Frequently Asked Questions
What is CVE-2026-24075? +
How severe is CVE-2026-24075? +
What products are affected by CVE-2026-24075? +
How do I check if I'm vulnerable to CVE-2026-24075? +
Related Vulnerabilities
A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet …
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support …
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and …
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, …
In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the …