CVE-2026-25290

Status: AnalyzedHigh (7.8)—

Memory Corruption when validating large data buffers from external sources using addition to check buffer length.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.07%
Percentile among all scored CVEs: 0
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Primary impactT1059 Command and Scripting Interpreterexecution75 %
Secondary impactT1565.001 Stored Data Manipulationimpact60 %

CWE-190 (Integer Overflow) en firmware Qualcomm con AV:L/PR:L permite escalada local. Corrupción de memoria por validación deficiente de buffers permite ejecución de código con privilegios elevados.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Restrict File and Directory Permissions Privileged Account Management Remote Data Storage

Affected technologies (7)

Qualcomm — Cologne Firmware Qualcomm — Fastconnect 7800 Firmware Qualcomm — Snapdragon X2 Elite Firmware Qualcomm — Wcd9378c Firmware Qualcomm — Wsa8840 Firmware Qualcomm — Wsa8845 Firmware Qualcomm — Wsa8845h Firmware

CWEs

CWE-190

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-25290",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25290",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-17T12:44:07.242420Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@qualcomm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@qualcomm.com",
      "affectedData": [
        {
          "vendor": "Qualcomm, Inc.",
          "product": "Snapdragon",
          "versions": [
            {
              "status": "affected",
              "version": "Cologne"
            },
            {
              "status": "affected",
              "version": "FastConnect 7800"
            },
            {
              "status": "affected",
              "version": "Snapdragon X2 Elite"
            },
            {
              "status": "affected",
              "version": "WCD9378C"
            },
            {
              "status": "affected",
              "version": "WSA8840"
            },
            {
              "status": "affected",
              "version": "WSA8845"
            },
            {
              "status": "affected",
              "version": "WSA8845H"
            }
          ],
          "platforms": [
            "Snapdragon Compute"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-17T05:17:01.650",
  "references": [
    {
      "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@qualcomm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@qualcomm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Memory Corruption when validating large data buffers from external sources using addition to check buffer length."
    }
  ],
  "lastModified": "2026-09-22T19:01:39.993",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E31E0C48-FB61-47C8-B28B-3A701E85E126"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "638DBC7F-456F-487D-BED2-2214DFF8BEE2"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:snapdragon_x2_elite_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FEA3409-34AF-4FFB-AB58-ABE600FBA9FC"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:snapdragon_x2_elite:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "025C1550-D3DC-434A-91E4-EBFE004F3628"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "91B32C89-3238-4FDF-BB3F-F6BAE829769B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA33DE15-C177-43B3-AD50-FF797753D12E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AE1A5841-5BCB-4033-ACB9-23F3FCA65309"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B47BF35-3AA0-4667-842E-19B0FE30BF3C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8A071672-9405-4418-9141-35CEADBB65AF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB7CF473-8B25-4851-91F2-1BD693CCDC85"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "91E591F2-8F72-4A5A-9264-2742EB2DABDA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "product-security@qualcomm.com"
}