CVE-2026-24090 Missing Authentication for Critical Function in HLOS

High 7.1 Published 1 Jun 2026 Updated 3 Jun 2026

Missing authentication in Qualcomm Snapdragon HLOS allows unauthorized modification of the boot flow, potentially leading to privilege escalation or code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24090?

CVE-2026-24090 is a high-severity authentication bypass vulnerability in Qualcomm Ar8031 Firmware, published on 1 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

Weakness: CWE-306

Which versions are affected by CVE-2026-24090?

It affects 217 products.

Products include Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware, Qualcomm Cologne Firmware, Qualcomm Cq7790 Firmware, Qualcomm Cq8725s Firmware, Qualcomm Cq8750m Firmware and 211 more.

How do I fix CVE-2026-24090?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-24090 being exploited?

There is no known exploitation of CVE-2026-24090 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Qualcomm Ar8031 Firmware vulnerabilities

Sources

Also known as 4384595, A-489079986, ASB-A-489079986, GHSA-q684-mwhh-phmm.