Medium · published October 6, 2026
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
| Product | Versions | Fixed in |
|---|---|---|
| qualcomm/snapdragon_g1_gen_2_gaming_platform_firmware | all versions | — |
| qualcomm/cologne_firmware | all versions | — |
| qualcomm/congo_firmware | all versions | — |
| qualcomm/cq2390m_firmware | all versions | — |
| qualcomm/cq2390s_firmware | all versions | — |
| qualcomm/sc8380xp_firmware | all versions | — |
| qualcomm/snapdragon_8_gen1_5g_firmware | all versions | — |
| qualcomm/snapdragon_662_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_865_5g_mobile_platform_firmware | all versions | — |
| qualcomm/sdr753_firmware | all versions | — |
| qualcomm/sm4850_firmware | all versions | — |
| qualcomm/sm4850p_firmware | all versions | — |
| qualcomm/sm4875_firmware | all versions | — |
| qualcomm/sm6225p_firmware | all versions | — |
| qualcomm/sm6450p_firmware | all versions | — |
| qualcomm/sm6475p_firmware | all versions | — |
| qualcomm/sm6475q_firmware | all versions | — |
| qualcomm/sm6650p_firmware | all versions | — |
| qualcomm/sm6850_firmware | all versions | — |
| qualcomm/sm7325p_firmware | all versions | — |
| qualcomm/sm7435_firmware | all versions | — |
| qualcomm/sm7435p_firmware | all versions | — |
| qualcomm/sm7525_firmware | all versions | — |
| qualcomm/sm7550_firmware | all versions | — |
| qualcomm/sm7550p_firmware | all versions | — |
| qualcomm/sm7635p_firmware | all versions | — |
| qualcomm/sm7675_firmware | all versions | — |
| qualcomm/sm7675p_firmware | all versions | — |
| qualcomm/sm7750p_firmware | all versions | — |
| qualcomm/sm8475p_firmware | all versions | — |
| qualcomm/sm8550p_firmware | all versions | — |
| qualcomm/sm8635_firmware | all versions | — |
| qualcomm/sm8635p_firmware | all versions | — |
| qualcomm/sm8650q_firmware | all versions | — |
| qualcomm/sm8735p_firmware | all versions | — |
| qualcomm/sm8750p_firmware | all versions | — |
| qualcomm/sm8845p_firmware | all versions | — |
| qualcomm/sm8950_firmware | all versions | — |
| qualcomm/sm8950p_firmware | all versions | — |
| qualcomm/sm8975_firmware | all versions | — |
| qualcomm/sm8975p_firmware | all versions | — |
| qualcomm/smart_audio_400_platform_firmware | all versions | — |
| qualcomm/snapdragon_4_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_4_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_460_mobile_platform_firmware | all versions | — |
| qualcomm/cq7790_firmware | all versions | — |
| qualcomm/cq8725s_firmware | all versions | — |
| qualcomm/cq8750m_firmware | all versions | — |
| qualcomm/cq8845s_firmware | all versions | — |
| qualcomm/cq8850ns_firmware | all versions | — |
| qualcomm/csra6620_firmware | all versions | — |
| qualcomm/csra6640_firmware | all versions | — |
| qualcomm/fastconnect_6200_firmware | all versions | — |
| qualcomm/fastconnect_6700_firmware | all versions | — |
| qualcomm/fastconnect_6900_firmware | all versions | — |
| qualcomm/fastconnect_7800_firmware | all versions | — |
| qualcomm/g1_gen_1_firmware | all versions | — |
| qualcomm/g2_gen_1_firmware | all versions | — |
| qualcomm/g3x_gen_2_firmware | all versions | — |
| qualcomm/iq-615_firmware | all versions | — |
| qualcomm/iq-8275_firmware | all versions | — |
| qualcomm/iq-9075_firmware | all versions | — |
| qualcomm/kalpeni_firmware | all versions | — |
| qualcomm/lemans_au_lgit_firmware | all versions | — |
| qualcomm/lemansau_firmware | all versions | — |
| qualcomm/mbm415_firmware | all versions | — |
| qualcomm/mbm715_firmware | all versions | — |
| qualcomm/milos_firmware | all versions | — |
| qualcomm/milos_iot_firmware | all versions | — |
| qualcomm/monaco_iot_firmware | all versions | — |
| qualcomm/netrani_firmware | all versions | — |
| qualcomm/orne_firmware | all versions | — |
| qualcomm/palawan25_firmware | all versions | — |
| qualcomm/pandeiro_firmware | all versions | — |
| qualcomm/q-4390_firmware | all versions | — |
| qualcomm/qam8255p_firmware | all versions | — |
| qualcomm/qamsrv1h_firmware | all versions | — |
| qualcomm/qamsrv1m_firmware | all versions | — |
| qualcomm/qca6391_firmware | all versions | — |
| qualcomm/qca6595au_firmware | all versions | — |
| qualcomm/qca6678aq_firmware | all versions | — |
| qualcomm/qca6698aq_firmware | all versions | — |
| qualcomm/qca6698au_firmware | all versions | — |
| qualcomm/qca6797aq_firmware | all versions | — |
| qualcomm/qca8695au_firmware | all versions | — |
| qualcomm/sxr2250p_firmware | all versions | — |
| qualcomm/themisto_firmware | all versions | — |
| qualcomm/wcd9335_firmware | all versions | — |
| qualcomm/wcd9370_firmware | all versions | — |
| qualcomm/wcd9371_firmware | all versions | — |
| qualcomm/wcd9375_firmware | all versions | — |
| qualcomm/wcd9378_firmware | all versions | — |
| qualcomm/wcd9380_firmware | all versions | — |
| qualcomm/wcd9385_firmware | all versions | — |
| qualcomm/wcd9390_firmware | all versions | — |
| qualcomm/wcd9395_firmware | all versions | — |
| qualcomm/wcn3910_firmware | all versions | — |
| qualcomm/wcn3950_firmware | all versions | — |
| qualcomm/wcn3980_firmware | all versions | — |
| qualcomm/wcn3988_firmware | all versions | — |
| qualcomm/wcn6450_firmware | all versions | — |
| qualcomm/wcn6650_firmware | all versions | — |
| qualcomm/wcn6755_firmware | all versions | — |
| qualcomm/wcn7760_firmware | all versions | — |
| qualcomm/wcn7860_firmware | all versions | — |
| qualcomm/wcn7861_firmware | all versions | — |
| qualcomm/wcn7880_firmware | all versions | — |
| qualcomm/wcn7881_firmware | all versions | — |
| qualcomm/wcn8841_firmware | all versions | — |
| qualcomm/wsa8810_firmware | all versions | — |
| qualcomm/wsa8815_firmware | all versions | — |
| qualcomm/wsa8830_firmware | all versions | — |
| qualcomm/wsa8832_firmware | all versions | — |
| qualcomm/wsa8835_firmware | all versions | — |
| qualcomm/wsa8840_firmware | all versions | — |
| qualcomm/wsa8845_firmware | all versions | — |
| qualcomm/wsa8845h_firmware | all versions | — |
| qualcomm/wsa8850_firmware | all versions | — |
| qualcomm/wsa8850w_firmware | all versions | — |
| qualcomm/wsa8855c_firmware | all versions | — |
| qualcomm/x1e80100_firmware | all versions | — |
| qualcomm/xrv7209_firmware | all versions | — |
| qualcomm/xrv9209_firmware | all versions | — |
| qualcomm/qcm2290_firmware | all versions | — |
| qualcomm/qcm4290_firmware | all versions | — |
| qualcomm/qcm4325_firmware | all versions | — |
| qualcomm/qcm4490_firmware | all versions | — |
| qualcomm/qcm5430_firmware | all versions | — |
| qualcomm/qcm6490_firmware | all versions | — |
| qualcomm/qcm8838_firmware | all versions | — |
| qualcomm/qcn9011_firmware | all versions | — |
| qualcomm/qcn9012_firmware | all versions | — |
| qualcomm/qcs2290_firmware | all versions | — |
| qualcomm/qcs4290_firmware | all versions | — |
| qualcomm/qcs4490_firmware | all versions | — |
| qualcomm/qcs6690_firmware | all versions | — |
| qualcomm/qcs8550_firmware | all versions | — |
| qualcomm/qln1083bd_firmware | all versions | — |
| qualcomm/qln1086bd_firmware | all versions | — |
| qualcomm/qmp1000_firmware | all versions | — |
| qualcomm/qmp2001_firmware | all versions | — |
| qualcomm/qna715_firmware | all versions | — |
| qualcomm/qpa1083bd_firmware | all versions | — |
| qualcomm/qpa1086bd_firmware | all versions | — |
| qualcomm/fastconnect_8800_mobile_connectivity_system_firmware | all versions | — |
| qualcomm/video_collaboration_vc1_platform_firmware | all versions | — |
| qualcomm/video_collaboration_vc3_platform_firmware | all versions | — |
| qualcomm/video_collaboration_vc5_platform_firmware | all versions | — |
| qualcomm/qxm1083_firmware | all versions | — |
| qualcomm/qxm1086_firmware | all versions | — |
| qualcomm/qxm1093_firmware | all versions | — |
| qualcomm/qxm1094_firmware | all versions | — |
| qualcomm/qxm1095_firmware | all versions | — |
| qualcomm/qxm1096_firmware | all versions | — |
| qualcomm/robotics_rb2_platform_firmware | all versions | — |
| qualcomm/sa7255p_firmware | all versions | — |
| qualcomm/sa7775p_firmware | all versions | — |
| qualcomm/sa8255p_firmware | all versions | — |
| qualcomm/sa8620p_firmware | all versions | — |
| qualcomm/sa8770p_firmware | all versions | — |
| qualcomm/sa9000p_firmware | all versions | — |
| qualcomm/sar1165p_firmware | all versions | — |
| qualcomm/sar2130p_firmware | all versions | — |
| qualcomm/snapdragon_480_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_480\+_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_4_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_680_4g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_685_4g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_695_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7_gen_4_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7\+_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_778g_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_778g\+_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_782g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7c\+_gen_3_compute_firmware | all versions | — |
| qualcomm/snapdragon_7s_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_elite_firmware | all versions | — |
| qualcomm/snapdragon_8_elite_gen_5_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_5_firmware | all versions | — |
| qualcomm/snapdragon_8\+_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8\+_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_888_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_888\+_5g_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_ar1_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_ar1\+_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_ride_elite_firmware | all versions | — |
| qualcomm/snapdragon_x53_5g_modem-rf_system_firmware | all versions | — |
| qualcomm/snapdragon_xr2_5g_platform_firmware | all versions | — |
| qualcomm/snapdragon_xr2\+_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_cockpit_elite_firmware | all versions | — |
| qualcomm/snapdragon_reality_elite_platform_firmware | all versions | — |
| qualcomm/snapdragon_wear_elite_platform_firmware | all versions | — |
| qualcomm/srv1h_firmware | all versions | — |
| qualcomm/srv1m_firmware | all versions | — |
| qualcomm/sw5100_firmware | all versions | — |
| qualcomm/sw5100p_firmware | all versions | — |
| qualcomm/sxr2230p_firmware | all versions | — |