CVE-2026-25255

Published: Sep 22, 2026Modified: Oct 6, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Exposed dangerous function lead to privilege escalation via gRPC server.

Affected (6)

Products: Qualcomm: Package Manager, Software Center

2 products

Package Manager

Software Center

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Qualcomm Package Manager	Version 3.0.125.4
Qualcomm Package Manager	Version 3.0.126.7
Qualcomm Package Manager	Version 3.0.127.2
Qualcomm Software Center	Version 1.17.1
Qualcomm Software Center	Version 1.19.1
Qualcomm Software Center	Version 1.21.0

Related CWEs

Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

References (1)

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html

Source: product-security@qualcomm.com

Vendor Advisory

Timeline

No history available yet.