Exploits Discovered in Qualcomm Firmware Affecting Poco M7 Plus

• •Two exploits identified in Qualcomm firmware affecting Poco M7 Plus.
• •CVE-2026-24088 allows temporary root access; CVE-2026-43499 results in kernel panic.
• •Both vulnerabilities have been publicly disclosed and patched.

Two exploits targeting the Qualcomm SM6375 chipset in the Poco M7 Plus have been documented, focusing on a missing authentication vulnerability in the Qualcomm Ar9380 firmware. The first exploit, CVE-2026-24088, was published on June 1, 2026, and allows temporary root access via the Qualcomm GBL exploit. The second exploit, CVE-2026-43499, published on May 21, 2026, was attempted but resulted in kernel panic. Both exploits were tested on HyperOS versions 2.0.202.0 and 2.0.208.0, revealing that the GBL exploit worked while the GhostLock approach failed. These vulnerabilities have been publicly disclosed and patched, but users are advised to check their devices for updates. The research was conducted in a controlled environment, and the authors emphasized the importance of ethical testing. The findings are significant for users of affected devices, particularly those who have not updated their firmware.