CVE-2026-25289
📛 CVE Title
Stack-based Buffer Overflow in WLAN Firmware
Description
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- qualcomm
- CVSS severity
- CRITICAL
- CVSS score
- 9.6 / 10
- CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Effective score
- 9.6 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-121 - Reserved
- 2026-02-02
- Published
- 2026-08-04 15:07 UTC
- Last updated
- 2026-08-05 03:56 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25289.json
- Linked Threat
- CVE-2026-25289 — Stack-based Buffer Overflow in WLAN Firmware
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Qualcomm, Inc. | Snapdragon |
AR8035 (affected),
Cologne (affected),
CQ7790 (affected),
CQ8725S (affected),
CQ8750M (affected),
FastConnect 6200 (affected),
FastConnect 6700 (affected),
FastConnect 6800 (affected),
FastConnect 6900 (affected),
FastConnect 7800 (affected),
FWA Gen 3 Ultra Platform (affected),
FWA Gen 5 Elite Platform (affected),
G2 Gen 1 (affected),
Immersive Home 3210 Platform (affected),
Immersive Home 326 Platform (affected),
IPQ5300 (affected),
IPQ5302 (affected),
IPQ5312 (affected),
IPQ5332 (affected),
IPQ9554 (affected),
IPQ9570 (affected),
IPQ9574 (affected),
IQ10 Series (affected),
IQX5121 (affected),
IQX7181 (affected),
Kobuk (affected),
LeMans_AU_LGIT (affected),
LeMansAU (affected),
Milos (affected),
Milos_IOT (affected),
Networking Pro 1210 Platform (affected),
Networking Pro 1610 Platform (affected),
Networking Pro 610 Platform (affected),
Networking Pro 810 Platform (affected),
Orne (affected),
Palawan25 (affected),
Pandeiro (affected),
QAM8255P (affected),
QAM8397P (affected),
QAM8797P (affected),
QAMSRV1H (affected),
QAMSRV1M (affected),
QCA0000 (affected),
QCA6391 (affected),
QCA6426 (affected),
QCA6436 (affected),
QCA6554A (affected),
QCA6564AU (affected),
QCA6574 (affected),
QCA6574A (affected),
QCA6574AU (affected),
QCA6584AU (affected),
QCA6595 (affected),
QCA6595AU (affected),
QCA6678AQ (affected),
QCA6688AQ (affected),
QCA6696 (affected),
QCA6698AQ (affected),
QCA6698AU (affected),
QCA6777AQ (affected),
QCA6787AQ (affected),
QCA6797AQ (affected),
QCA8075 (affected),
QCA8081 (affected),
QCA8337 (affected),
QCA8386 (affected),
QCA8695AU (affected),
QCC2073 (affected),
QCC2076 (affected),
QCC710 (affected),
QCF8000 (affected),
QCF8001 (affected),
QCM8550 (affected),
QCM8838 (affected),
QCN5124 (affected),
QCN6224 (affected),
QCN6274 (affected),
QCN6402 (affected),
QCN6412 (affected),
QCN6422 (affected),
QCN6432 (affected),
QCN9011 (affected),
QCN9012 (affected),
QCN9274 (affected),
QCS6690 (affected),
QCS8550 (affected),
QFW7114 (affected),
QFW7124 (affected),
QLN1083BD (affected),
QLN1086BD (affected),
QMB715 (affected),
QMP1000 (affected),
QPA1083BD (affected),
QPA1086BD (affected),
QXM1083 (affected),
QXM1086 (affected),
QXM1093 (affected),
QXM1094 (affected),
QXM1095 (affected),
QXM1096 (affected),
SA7255P (affected),
SA7775P (affected),
SA8255P (affected),
SA8620P (affected),
SA8770P (affected),
SA9000P (affected),
SAR1165P (affected),
SAR2130P (affected),
SC8380XP (affected),
SD 8 Gen1 5G (affected),
SD865 5G (affected),
SDR753 (affected),
SDX81 (affected),
SM6650P (affected),
SM7635P (affected),
SM7675 (affected),
SM7675P (affected),
SM8550P (affected),
SM8635 (affected),
SM8635P (affected),
SM8650Q (affected),
SM8750P (affected),
Snapdragon 6 Gen 4 Mobile Platform (affected),
Snapdragon 7 Gen 4 Mobile Platform (affected),
Snapdragon 7s Gen 3 Mobile Platform (affected),
Snapdragon 8 Elite (affected),
Snapdragon 8 Elite Gen 5 (affected),
Snapdragon 8 Gen 1 Mobile Platform (affected),
Snapdragon 8 Gen 2 Mobile Platform (affected),
Snapdragon 8 Gen 3 Mobile Platform (affected),
Snapdragon 8+ Gen 2 Mobile Platform (affected),
Snapdragon 865 5G Mobile Platform (affected),
Snapdragon 865+ 5G Mobile Platform (affected),
Snapdragon 870 5G Mobile Platform (affected),
Snapdragon AR1 Gen 1 Platform (affected),
Snapdragon AR1+ Gen 1 Platform (affected),
Snapdragon Auto 5G Modem-RF Gen 2 (affected),
Snapdragon X72 5G Modem-RF System (affected),
Snapdragon X75 5G Modem-RF System (affected),
Snapdragon XR2 5G Platform (affected),
Snapdragon Wear Elite platform (affected),
SRV1H (affected),
SRV1M (affected),
SSG2115P (affected),
SSG2125P (affected),
SXR1230P (affected),
SXR2230P (affected),
SXR2250P (affected),
SXR2330P (affected),
SXR2350P (affected),
Themisto (affected),
WCD9340 (affected),
WCD9370 (affected),
WCD9375 (affected),
WCD9378 (affected),
WCD9378C (affected),
WCD9380 (affected),
WCD9385 (affected),
WCD9390 (affected),
WCD9395 (affected),
WCN3988 (affected),
WCN6450 (affected),
WCN6650 (affected),
WCN6740 (affected),
WCN6755 (affected),
WCN7860 (affected),
WCN7861 (affected),
WCN7880 (affected),
WCN7881 (affected),
WSA8810 (affected),
WSA8815 (affected),
WSA8830 (affected),
WSA8832 (affected),
WSA8835 (affected),
WSA8840 (affected),
WSA8845 (affected),
WSA8845H (affected),
X1E80100 (affected),
X2000077 (affected),
X2000086 (affected),
X2000090 (affected),
X2000092 (affected),
X2000094 (affected),
XG101002 (affected),
XG101032 (affected),
XG101039 (affected),
XRV7209 (affected),
XRV9209 (affected)
|
Snapdragon Auto, Snapdragon CCW, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon MC, Snapdragon Mobile, Snapdragon Technology, Snapdragon WBC, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-25289.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:23.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Snapdragon Auto",
"Snapdragon CCW",
"Snapdragon Compute",
"Snapdragon Connectivity",
"Snapdragon Consumer Electronics Connectivity",
"Snapdragon Consumer IOT",
"Snapdragon Industrial IOT",
"Snapdragon MC",
"Snapdragon Mobile",
"Snapdragon Technology",
"Snapdragon WBC",
"Snapdragon Wearables",
"Snapdragon Wired Infrastructure and Networking"
],
"product": "Snapdragon",
"vendor": "Qualcomm, Inc.",
"versions": [
{
"status": "affected",
"version": "AR8035"
},
{
"status": "affected",
"version": "Cologne"
},
{
"status": "affected",
"version": "CQ7790"
},
{
"status": "affected",
"version": "CQ8725S"
},
{
"status": "affected",
"version": "CQ8750M"
},
{
"status": "affected",
"version": "FastConnect 6200"
},
{
"status": "affected",
"version": "FastConnect 6700"
},
{
"status": "affected",
"version": "FastConnect 6800"
},
{
"status": "affected",
"version": "FastConnect 6900"
},
{
"status": "affected",
"version": "FastConnect 7800"
},
{
"status": "affected",
"version": "FWA Gen 3 Ultra Platform"
},
{
"status": "affected",
"version": "FWA Gen 5 Elite Platform"
},
{
"status": "affected",
"version": "G2 Gen 1"
},
{
"status": "affected",
"version": "Immersive Home 3210 Platform"
},
{
"status": "affected",
"version": "Immersive Home 326 Platform"
},
{
"status": "affected",
"version": "IPQ5300"
},
{
"status": "affected",
"version": "IPQ5302"
},
{
"status": "affected",
"version": "IPQ5312"
},
{
"status": "affected",
"version": "IPQ5332"
},
{
"status": "affected",
"version": "IPQ9554"
},
{
"status": "affected",
"version": "IPQ9570"
},
{
"status": "affected",
"version": "IPQ9574"
},
{
"status": "affected",
"version": "IQ10 Series"
},
{
"status": "affected",
"version": "IQX5121"
},
{
"status": "affected",
"version": "IQX7181"
},
{
"status": "affected",
"version": "Kobuk"
},
{
"status": "affected",
"version": "LeMans_AU_LGIT"
},
{
"status": "affected",
"version": "LeMansAU"
},
{
"status": "affected",
"version": "Milos"
},
{
"status": "affected",
"version": "Milos_IOT"
},
{
"status": "affected",
"version": "Networking Pro 1210 Platform"
},
{
"status": "affected",
"version": "Networking Pro 1610 Platform"
},
{
"status": "affected",
"version": "Networking Pro 610 Platform"
},
{
"status": "affected",
"version": "Networking Pro 810 Platform"
},
{
"status": "affected",
"version": "Orne"
},
{
"status": "affected",
"version": "Palawan25"
},
{
"status": "affected",
"version": "Pandeiro"
},
{
"status": "affected",
"version": "QAM8255P"
},
{
"status": "affected",
"version": "QAM8397P"
},
{
"status": "affected",
"version": "QAM8797P"
},
{
"status": "affected",
"version": "QAMSRV1H"
},
{
"status": "affected",
"version": "QAMSRV1M"
},
{
"status": "affected",
"version": "QCA0000"
},
{
"status": "affected",
"version": "QCA6391"
},
{
"status": "affected",
"version": "QCA6426"
},
{
"status": "affected",
"version": "QCA6436"
},
{
"status": "affected",
"version": "QCA6554A"
},
{
"status": "affected",
"version": "QCA6564AU"
},
{
"status": "affected",
"version": "QCA6574"
},
{
"status": "affected",
"version": "QCA6574A"
},
{
"status": "affected",
"version": "QCA6574AU"
},
{
"status": "affected",
"version": "QCA6584AU"
},
{
"status": "affected",
"version": "QCA6595"
},
{
"status": "affected",
"version": "QCA6595AU"
},
{
"status": "affected",
"version": "QCA6678AQ"
},
{
"status": "affected",
"version": "QCA6688AQ"
},
{
"status": "affected",
"version": "QCA6696"
},
{
"status": "affected",
"version": "QCA6698AQ"
},
{
"status": "affected",
"version": "QCA6698AU"
},
{
"status": "affected",
"version": "QCA6777AQ"
},
{
"status": "affected",
"version": "QCA6787AQ"
},
{
"status": "affected",
"version": "QCA6797AQ"
},
{
"status": "affected",
"version": "QCA8075"
},
{
"status": "affected",
"version": "QCA8081"
},
{
"status": "affected",
"version": "QCA8337"
},
{
"status": "affected",
"version": "QCA8386"
},
{
"status": "affected",
"version": "QCA8695AU"
},
{
"status": "affected",
"version": "QCC2073"
},
{
"status": "affected",
"version": "QCC2076"
},
{
"status": "affected",
"version": "QCC710"
},
{
"status": "affected",
"version": "QCF8000"
},
{
"status": "affected",
"version": "QCF8001"
},
{
"status": "affected",
"version": "QCM8550"
},
{
"status": "affected",
"version": "QCM8838"
},
{
"status": "affected",
"version": "QCN5124"
},
{
"status": "affected",
"version": "QCN6224"
},
{
"status": "affected",
"version": "QCN6274"
},
{
"status": "affected",
"version": "QCN6402"
},
{
"status": "affected",
"version": "QCN6412"
},
{
"status": "affected",
"version": "QCN6422"
},
{
"status": "affected",
"version": "QCN6432"
},
{
"status": "affected",
"version": "QCN9011"
},
{
"status": "affected",
"version": "QCN9012"
},
{
"status": "affected",
"version": "QCN9274"
},
{
"status": "affected",
"version": "QCS6690"
},
{
"status": "affected",
"version": "QCS8550"
},
{
"status": "affected",
"version": "QFW7114"
},
{
"status": "affected",
"version": "QFW7124"
},
{
"status": "affected",
"version": "QLN1083BD"
},
{
"status": "affected",
"version": "QLN1086BD"
},
{
"status": "affected",
"version": "QMB715"
},
{
"status": "affected",
"version": "QMP1000"
},
{
"status": "affected",
"version": "QPA1083BD"
},
{
"status": "affected",
"version": "QPA1086BD"
},
{
"status": "affected",
"version": "QXM1083"
},
{
"status": "affected",
"version": "QXM1086"
},
{
"status": "affected",
"version": "QXM1093"
},
{
"status": "affected",
"version": "QXM1094"
},
{
"status": "affected",
"version": "QXM1095"
},
{
"status": "affected",
"version": "QXM1096"
},
{
"status": "affected",
"version": "SA7255P"
},
{
"status": "affected",
"version": "SA7775P"
},
{
"status": "affected",
"version": "SA8255P"
},
{
"status": "affected",
"version": "SA8620P"
},
{
"status": "affected",
"version": "SA8770P"
},
{
"status": "affected",
"version": "SA9000P"
},
{
"status": "affected",
"version": "SAR1165P"
},
{
"status": "affected",
"version": "SAR2130P"
},
{
"status": "affected",
"version": "SC8380XP"
},
{
"status": "affected",
"version": "SD 8 Gen1 5G"
},
{
"status": "affected",
"version": "SD865 5G"
},
{
"status": "affected",
"version": "SDR753"
},
{
"status": "affected",
"version": "SDX81"
},
{
"status": "affected",
"version": "SM6650P"
},
{
"status": "affected",
"version": "SM7635P"
},
{
"status": "affected",
"version": "SM7675"
},
{
"status": "affected",
"version": "SM7675P"
},
{
"status": "affected",
"version": "SM8550P"
},
{
"status": "affected",
"version": "SM8635"
},
{
"status": "affected",
"version": "SM8635P"
},
{
"status": "affected",
"version": "SM8650Q"
},
{
"status": "affected",
"version": "SM8750P"
},
{
"status": "affected",
"version": "Snapdragon 6 Gen 4 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 7 Gen 4 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 7s Gen 3 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8 Elite"
},
{
"status": "affected",
"version": "Snapdragon 8 Elite Gen 5"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 1 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 2 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 3 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8+ Gen 2 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 865 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 865+ 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 870 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon AR1 Gen 1 Platform"
},
{
"status": "affected",
"version": "Snapdragon AR1+ Gen 1 Platform"
},
{
"status": "affected",
"version": "Snapdragon Auto 5G Modem-RF Gen 2"
},
{
"status": "affected",
"version": "Snapdragon X72 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X75 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon XR2 5G Platform"
},
{
"status": "affected",
"version": "Snapdragon Wear Elite platform"
},
{
"status": "affected",
"version": "SRV1H"
},
{
"status": "affected",
"version": "SRV1M"
},
{
"status": "affected",
"version": "SSG2115P"
},
{
"status": "affected",
"version": "SSG2125P"
},
{
"status": "affected",
"version": "SXR1230P"
},
{
"status": "affected",
"version": "SXR2230P"
},
{
"status": "affected",
"version": "SXR2250P"
},
{
"status": "affected",
"version": "SXR2330P"
},
{
"status": "affected",
"version": "SXR2350P"
},
{
"status": "affected",
"version": "Themisto"
},
{
"status": "affected",
"version": "WCD9340"
},
{
"status": "affected",
"version": "WCD9370"
},
{
"status": "affected",
"version": "WCD9375"
},
{
"status": "affected",
"version": "WCD9378"
},
{
"status": "affected",
"version": "WCD9378C"
},
{
"status": "affected",
"version": "WCD9380"
},
{
"status": "affected",
"version": "WCD9385"
},
{
"status": "affected",
"version": "WCD9390"
},
{
"status": "affected",
"version": "WCD9395"
},
{
"status": "affected",
"version": "WCN3988"
},
{
"status": "affected",
"version": "WCN6450"
},
{
"status": "affected",
"version": "WCN6650"
},
{
"status": "affected",
"version": "WCN6740"
},
{
"status": "affected",
"version": "WCN6755"
},
{
"status": "affected",
"version": "WCN7860"
},
{
"status": "affected",
"version": "WCN7861"
},
{
"status": "affected",
"version": "WCN7880"
},
{
"status": "affected",
"version": "WCN7881"
},
{
"status": "affected",
"version": "WSA8810"
},
{
"status": "affected",
"version": "WSA8815"
},
{
"status": "affected",
"version": "WSA8830"
},
{
"status": "affected",
"version": "WSA8832"
},
{
"status": "affected",
"version": "WSA8835"
},
{
"status": "affected",
"version": "WSA8840"
},
{
"status": "affected",
"version": "WSA8845"
},
{
"status": "affected",
"version": "WSA8845H"
},
{
"status": "affected",
"version": "X1E80100"
},
{
"status": "affected",
"version": "X2000077"
},
{
"status": "affected",
"version": "X2000086"
},
{
"status": "affected",
"version": "X2000090"
},
{
"status": "affected",
"version": "X2000092"
},
{
"status": "affected",
"version": "X2000094"
},
{
"status": "affected",
"version": "XG101002"
},
{
"status": "affected",
"version": "XG101032"
},
{
"status": "affected",
"version": "XG101039"
},
{
"status": "affected",
"version": "XRV7209"
},
{
"status": "affected",
"version": "XRV9209"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T15:07:23.222Z",
"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"shortName": "qualcomm"
},
"references": [
{
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html"
}
],
"title": "Stack-based Buffer Overflow in WLAN Firmware"
}
},
"cveMetadata": {
"assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"assignerShortName": "qualcomm",
"cveId": "CVE-2026-25289",
"datePublished": "2026-08-04T15:07:23.222Z",
"dateReserved": "2026-02-02T04:19:00.942Z",
"dateUpdated": "2026-08-05T03:56:23.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}