PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25265 Qualcomm, Inc. CVE debrief

CVE-2026-25265 is a high-severity vulnerability in Qualcomm's Software Center, allowing for privilege escalation due to weak configuration while handling temporary files. The CVE record was published on 2026-09-22T10:17:09.243Z and was last modified on 2026-09-25T13:37:33.170Z. The NVD entry is currently Analyzed. This vulnerability has a CVSS score of 8.8 and is related to CWE-378. Affected versions include 1.17.1, 1.19.1, 1.21.0, 1.22.1, 1.25.1, and 1.26.0. Defenders and administrators responsible for Qualcomm Software Center installations should assess exposure, verify affected versions, and prioritize remediation to prevent potential privilege escalation attacks. The weak is a

Vendor
Qualcomm, Inc.
Product
Snapdragon
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-22
Original CVE updated
2026-09-25
Advisory published
2026-09-22
Advisory updated
2026-09-25

Who should care

Defenders and administrators responsible for Qualcomm Software Center installations, especially in environments where privilege escalation could have significant impacts, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-25265 is a high-severity vulnerability in Qualcomm's Software Center that allows for privilege escalation. Defenders and administrators should assess exposure, verify affected versions, and prioritize remediation to prevent potential privilege escalation attacks.

  • Potential privilege escalation in Qualcomm Software Center installations
  • Weak configuration while handling temporary files could lead to elevated privileges
  • Verification of affected versions and configurations is necessary
  • Remediation priority is high due to the CVSS score of 8.8

Technical summary

CVE-2026-25265 is a high-severity vulnerability in Qualcomm's Software Center, allowing for privilege escalation due to weak configuration while handling temporary files. The vulnerability has a CVSS score of 8.8 and is related to CWE-378. Affected versions include 1.17.1, 1.19.1, 1.21.0, 1.22.1, 1.25.1, and 1.26.0.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Qualcomm Software Center installations, especially in environments where privilege escalation could have significant impacts.

Recommended defensive actions

  • Verify Qualcomm Software Center installations for vulnerability
  • Apply patches or updates as available
  • Review and strengthen configuration for temporary file handling
  • Monitor for potential privilege escalation attempts

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score of 8.8 and weaknesses related to CWE-378. However, specific details about exploitation, impact, and remediation are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25265 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25265

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25265 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25265

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html

    [email protected] - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.