CVE-2026-25266 Qualcomm, Inc. CVE debrief

Who should care

Device manufacturers and users of affected Qualcomm products should assess their exposure and prioritize patching. This includes reviewing inventory, applying security updates, and monitoring for potential impacts.

Why it matters

CVE-2026-25266 is a medium-severity vulnerability affecting multiple Qualcomm products. It can lead to memory corruption when processing IOCTL commands in a power-save state. Device manufacturers and users must assess exposure, apply patches, and monitor for potential impacts.

• Denial of service due to device crashes or instability.
• Potential for additional exploitation if other vulnerabilities are present.
• Requires verification of affected versions and exposure.
• Patching and inventory management are crucial for mitigation.

Technical summary

The CVE-2026-25266 vulnerability involves a memory corruption issue that occurs while processing IOCTL commands when a device is in a power-save state. This vulnerability affects multiple Qualcomm products, including various firmware and hardware components such as the Cologne firmware, FastConnect 6900 firmware, and Snapdragon AR1 Gen 1 firmware, among others. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 5.5, with a Medium severity rating based on the Common Vulnerability Scoring System (CVSS) v3.1. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating that the vulnerability can be exploited locally with low attack complexity and privileges, requiring no user interaction, and can result in a high impact on availability.

Defensive priority

Medium priority for device manufacturers and users of affected Qualcomm products, as exploitation could lead to denial of service or potentially other impacts if additional vulnerabilities are present.

Recommended defensive actions

• Review and apply Qualcomm's security bulletin updates for affected products.
• Inventory and assess exposure of Qualcomm products in your environment.
• Monitor for and respond to potential denial of service or other impacts if additional vulnerabilities are present.

Evidence notes

The CVE and NVD records provide details on the vulnerability, including its description, CVSS score, and affected products. Qualcomm has released a security bulletin addressing this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.