Memory corruption in Qualcomm satellite data file decoding

Successful exploitation can cause memory corruption in the vulnerable Qualcomm component, with potential high impact to confidentiality, integrity, and availability. The provided CVSS v3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates exploitation is low complexity, requires no privileges and no user interaction, and may result in severe compromise of the affected component, including possible code execution or complete compromise of the vulnerable processing context, as well as denial of service.

Until patched firmware or OEM security updates are installed, reduce exposure by limiting attack paths that can deliver malformed satellite data to the vulnerable component. Because the CVSS vector specifies adjacent attack exposure (AV:A), mitigation should focus on restricting nearby/adjacent interfaces and any feature paths that process satellite data files where operationally feasible. Definitive mitigation guidance beyond patching is not available in the provided content.

Apply the vendor-provided fix from Qualcomm referenced in its April 2026 security bulletin, and deploy Android security updates that include the Qualcomm closed-source component patch. The provided context indicates Google incorporated fixes for this issue in the June 2026 Android security release, and Samsung also included a fix in its April 2026 Security Maintenance Release for affected devices.