CVE-2026-25263

Undergoing Analysis Undergoing Analysis - In Progress

Memory Corruption in Qualcomm Kernel via IOCTL

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Qualcomm, Inc.

Description

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-25263

EUVD

EUVD-2026-92970

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	snapdragon_g1_gen_2_gaming_platform_firmware	*
qualcomm	5g_fixed_wireless_access_platform_firmware	*
qualcomm	9205_lte_modem_firmware	*
qualcomm	9205s_modem_firmware	*
qualcomm	aqt1000_firmware	*
qualcomm	snapdragon_8c_compute_platform_(sc8180xp-ad)_firmware	*
qualcomm	snapdragon_8cx_compute_platform_firmware	*
qualcomm	snapdragon_8cx_compute_platform_"poipu_pro"_firmware	*
qualcomm	snapdragon_8cx_gen_2_5g_compute_platform_firmware	*
qualcomm	snapdragon_8cx_gen_2_5g_compute_platform_"poipu_pro"_firmware	*
qualcomm	snapdragon_auto_5g_modem-rf_firmware	*
qualcomm	snapdragon_wear_1300_platform_firmware	*
qualcomm	snapdragon_x53_5g_modem-rf_system_firmware	*
qualcomm	snapdragon_x55_5g_modem-rf_system_firmware	*
qualcomm	snapdragon_xr2_5g_platform_firmware	*
qualcomm	snapdragon_xr2+_gen_1_platform_firmware	*
qualcomm	snapdragon_auto_4g_modem_firmware	*
qualcomm	vision_intelligence_400_platform_firmware	*
qualcomm	wcd9306_firmware	*
qualcomm	wcd9335_firmware	*
qualcomm	wcd9340_firmware	*
qualcomm	wcd9341_firmware	*
qualcomm	wcd9360_firmware	*
qualcomm	wcd9370_firmware	*
qualcomm	wcd9371_firmware	*
qualcomm	wcd9375_firmware	*
qualcomm	wcd9378_firmware	*
qualcomm	wcd9380_firmware	*
qualcomm	wcd9385_firmware	*
qualcomm	wcd9390_firmware	*
qualcomm	wcd9395_firmware	*
qualcomm	wcn3910_firmware	*
qualcomm	wcn3950_firmware	*
qualcomm	wcn3980_firmware	*
qualcomm	wcn3988_firmware	*
qualcomm	wcn3990_firmware	*
qualcomm	wcn6650_firmware	*
qualcomm	wcn6755_firmware	*
qualcomm	wsa8810_firmware	*
qualcomm	wsa8815_firmware	*
qualcomm	wsa8830_firmware	*
qualcomm	wsa8832_firmware	*
qualcomm	wsa8835_firmware	*
qualcomm	wsa8840_firmware	*
qualcomm	wsa8845_firmware	*
qualcomm	ar8031_firmware	*
qualcomm	c-v2x_9150_firmware	*
qualcomm	csra6620_firmware	*
qualcomm	csra6640_firmware	*
qualcomm	csrb31024_firmware	*
qualcomm	fastconnect_6200_firmware	*
qualcomm	fastconnect_6700_firmware	*
qualcomm	fastconnect_6800_firmware	*
qualcomm	fastconnect_6900_firmware	*
qualcomm	fastconnect_7800_firmware	*
qualcomm	flight_rb5_5g_platform_firmware	*
qualcomm	fsm100_platform_firmware	*
qualcomm	g1_gen_1_firmware	*
qualcomm	g2_gen_1_firmware	*
qualcomm	g3x_gen_2_firmware	*
qualcomm	iq-615_firmware	*
qualcomm	iq-8275_firmware	*
qualcomm	iq-9075_firmware	*
qualcomm	iqx5121_firmware	*
qualcomm	iqx7181_firmware	*
qualcomm	mbm415_firmware	*
qualcomm	monaco_iot_firmware	*
qualcomm	netrani_firmware	*
qualcomm	qca0000_firmware	*
qualcomm	qca2066_firmware	*
qualcomm	qca4004_firmware	*
qualcomm	qca6391_firmware	*
qualcomm	qca6420_firmware	*
qualcomm	qca6430_firmware	*
qualcomm	qca6564_firmware	*
qualcomm	qca6564a_firmware	*
qualcomm	qca6564au_firmware	*
qualcomm	qca6574_firmware	*
qualcomm	qca6574a_firmware	*
qualcomm	qca6574au_firmware	*
qualcomm	qca6595_firmware	*
qualcomm	qca6595au_firmware	*
qualcomm	qca6688aq_firmware	*
qualcomm	qca6696_firmware	*
qualcomm	qca6698aq_firmware	*
qualcomm	wsa8845h_firmware	*
qualcomm	qca6698au_firmware	*
qualcomm	qca6797aq_firmware	*
qualcomm	qcc710_firmware	*
qualcomm	qcm2290_firmware	*
qualcomm	qcm4290_firmware	*
qualcomm	qcm4325_firmware	*
qualcomm	qcm4490_firmware	*
qualcomm	qcm5430_firmware	*
qualcomm	qcm6125_firmware	*
qualcomm	qcm6490_firmware	*
qualcomm	qcn9011_firmware	*
qualcomm	qcn9012_firmware	*
qualcomm	qcs2290_firmware	*
qualcomm	qcs4290_firmware	*
qualcomm	qcs4490_firmware	*
qualcomm	qcs8550_firmware	*
qualcomm	qts110_firmware	*
qualcomm	video_collaboration_vc1_platform_firmware	*
qualcomm	video_collaboration_vc3_platform_firmware	*
qualcomm	video_collaboration_vc5_platform_firmware	*
qualcomm	robotics_rb2_platform_firmware	*
qualcomm	robotics_rb5_platform_firmware	*
qualcomm	sa2150p_firmware	*
qualcomm	sa4150p_firmware	*
qualcomm	sa4155p_firmware	*
qualcomm	sa6145p_firmware	*
qualcomm	sa6150p_firmware	*
qualcomm	sa6155_firmware	*
qualcomm	sa6155p_firmware	*
qualcomm	sa8145p_firmware	*
qualcomm	sa8150p_firmware	*
qualcomm	sa8155_firmware	*
qualcomm	sa8155p_firmware	*
qualcomm	sa8195p_firmware	*
qualcomm	sc8380xp_firmware	*
qualcomm	snapdragon_8_gen1_5g_firmware	*
qualcomm	snapdragon_662_mobile_platform_firmware	*
qualcomm	snapdragon_865_5g_mobile_platform_firmware	*
qualcomm	sm6225p_firmware	*
qualcomm	sm6250_firmware	*
qualcomm	sm6450p_firmware	*
qualcomm	sm6475p_firmware	*
qualcomm	sm6475q_firmware	*
qualcomm	sm7325p_firmware	*
qualcomm	sm7435_firmware	*
qualcomm	sm7435p_firmware	*
qualcomm	sm7525_firmware	*
qualcomm	sm7550_firmware	*
qualcomm	sm7550p_firmware	*
qualcomm	sm7635p_firmware	*
qualcomm	sm8475p_firmware	*
qualcomm	sm8550p_firmware	*
qualcomm	smart_audio_400_platform_firmware	*
qualcomm	snapdragon_4_gen_1_mobile_platform_firmware	*
qualcomm	snapdragon_4_gen_2_mobile_platform_firmware	*
qualcomm	snapdragon_460_mobile_platform_firmware	*
qualcomm	snapdragon_480_5g_mobile_platform_firmware	*
qualcomm	snapdragon_480+_5g_mobile_platform_firmware	*
qualcomm	snapdragon_6_gen_1_mobile_platform_firmware	*
qualcomm	snapdragon_6_gen_3_mobile_platform_firmware	*
qualcomm	snapdragon_680_4g_mobile_platform_firmware	*
qualcomm	snapdragon_685_4g_mobile_platform_firmware	*
qualcomm	snapdragon_695_5g_mobile_platform_firmware	*
qualcomm	snapdragon_7_gen_1_mobile_platform_firmware	*
qualcomm	snapdragon_7+_gen_2_mobile_platform_firmware	*
qualcomm	snapdragon_778g_5g_mobile_platform_firmware	*
qualcomm	snapdragon_778g+_5g_mobile_platform_firmware	*
qualcomm	snapdragon_782g_mobile_platform_firmware	*
qualcomm	snapdragon_7c_compute_platform_firmware	*
qualcomm	snapdragon_7c_gen_2_compute_platform_firmware	*
qualcomm	snapdragon_7c+_gen_3_compute_firmware	*
qualcomm	snapdragon_8_gen_1_mobile_platform_firmware	*
qualcomm	snapdragon_8_gen_2_mobile_platform_firmware	*
qualcomm	snapdragon_8+_gen_1_mobile_platform_firmware	*
qualcomm	snapdragon_8+_gen_2_mobile_platform_firmware	*
qualcomm	snapdragon_865+_5g_mobile_platform_firmware	*
qualcomm	snapdragon_870_5g_mobile_platform_firmware	*
qualcomm	snapdragon_888_5g_mobile_platform_firmware	*
qualcomm	snapdragon_888+_5g_mobile_platform_firmware	*
qualcomm	snapdragon_8c_compute_platform_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves memory corruption in the kernel when processing an IOCTL command from user space with invalid parameters. This can lead to system instability or unauthorized access.

Impact Analysis

It may cause system crashes, privilege escalation, or data corruption. Attackers could exploit this to gain control over affected devices running Qualcomm Snapdragon processors.

Mitigation Strategies

Apply vendor patches or updates for Qualcomm Snapdragon devices immediately. Disable or restrict access to IOCTL commands from user space if possible. Monitor system logs for memory corruption errors or kernel crashes.

Hi! I’m here to help you understand CVE-2026-25263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70