A weakness in signature verification allows processors that handle non‑ELF boot partitions to bypass all authentication checks. This lets an attacker mount an unsigned or corrupted image and have it processed as a legitimate boot component. The flaw is an instance of Improper Verification of Cryptographic Signature (CWE‑347) and could grant an attacker code execution with the privileges of the device during startup, potentially leading to full system compromise.

The vulnerability affects Qualcomm’s Snapdragon platform. No specific model or firmware version range is listed, so all Snapdragon releases that rely on the affected boot partition processing logic are potentially impacted.

The CVSS score is 7.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves supply‑chain or physical tampering with the device’s storage of non‑ELF boot images, which can be performed before or during manufacturing or by a compromised development environment. Once the unsigned image is presented to the boot processor, the bypass allows the system to load and execute malicious code without cryptographic validation.