CVE-2026-25262

nvd nist

Published: Sep 22, 2026Modified: Oct 6, 2026

6.3

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.4 / Impact: 5.9

Source: NVD

Description

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

Affected (8)

Products: Qualcomm: Mdm9207 Firmware, Mdm9655 Firmware, Mdm9665 Firmware, Msm8909 Firmware, Msm8916 Firmware, Msm8952 Firmware, Sdx50 Firmware, Mdm9645 Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Mdm9207 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Mdm9207	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Mdm9655 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Mdm9655	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Mdm9665 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Mdm9665	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Msm8909 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Msm8909	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Msm8916 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Msm8916	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Msm8952 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Msm8952	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdx50 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdx50	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Mdm9645 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Mdm9645	All versions

Related CWEs

CWE-123

Write-what-where Condition

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

References (1)

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html

Source: product-security@qualcomm.com

Vendor Advisory

Timeline

No history available yet.