CVE-2026-25262 - Vulnerability Details

- Write-what-where Condition in Primary Bootloader

Description

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

Published: 2026-09-22

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Memory corruption occurs when the primary bootloader parses a specially crafted ELF file. The flaw can allow an attacker to overwrite critical bootloader data, potentially leading to arbitrary code execution with system‑level privileges.

Affected Systems

Qualcomm Snapdragon platforms are affected. Specific models or firmware revisions are not listed, so any Snapdragon‑based device that uses the primary bootloader with the affected code may be vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates significant severity. The EPSS score is not available, so exploitation probability is unknown; the vulnerability is not currently listed in CISA KEV. The attack vector is inferred to require delivering a crafted ELF file during the bootloader’s loading phase, such as during a firmware update or manual flashing, implying a close or physical access scenario.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Qualcomm, Inc.

Snapdragon

unaffected

Version	Status	Constraints
`MDM9x07`	affected	—
`MDM9x45`	affected	—
`MDM9x55`	affected	—
`MDM9x65`	affected	—
`MSM8909`	affected	—
`MSM8916`	affected	—
`MSM8952`	affected	—
`SDX50`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:qualcomm:mdm9207_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9207:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:qualcomm:mdm9655_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9655:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:qualcomm:mdm9665_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9665:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:qualcomm:msm8909_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:msm8909:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:qualcomm:msm8916_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:msm8916:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:qualcomm:msm8952_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:msm8952:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:qualcomm:sdx50_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:sdx50:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:qualcomm:mdm9645_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9645:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Qualcomm

Snapdragon

95%

Version	Status	Scheme	Platform
`MDM9x07`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MDM9x45`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MDM9x55`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MDM9x65`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MSM8909`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MSM8916`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`MSM8952`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']
`SDX50`	affected	generic	['snapdragon_auto', 'snapdragon_industrial_iot', 'snapdragon_iot', 'snapdragon_mobile', 'snapdragon_voice_&_music', 'snapdragon_wearables']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Qualcomm firmware update that addresses the primary bootloader issue.
Ensure that only signed, authenticated firmware images are accepted by the bootloader.
Restrict physical access to the device’s flashing port or use lockout mechanisms to prevent unauthorized updates.

Generated by OpenCVE AI on September 22, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Physical

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00135.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html

History

Tue, 06 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Qualcomm mdm9207 Qualcomm mdm9207 Firmware Qualcomm mdm9645 Qualcomm mdm9645 Firmware Qualcomm mdm9655 Qualcomm mdm9655 Firmware Qualcomm mdm9665 Qualcomm mdm9665 Firmware Qualcomm msm8909 Qualcomm msm8909 Firmware Qualcomm msm8916 Qualcomm msm8916 Firmware Qualcomm msm8952 Qualcomm msm8952 Firmware Qualcomm sdx50 Qualcomm sdx50 Firmware
CPEs		cpe:2.3:h:qualcomm:mdm9207:-:::::::* cpe:2.3:h:qualcomm:mdm9645:-:::::::* cpe:2.3:h:qualcomm:mdm9655:-:::::::* cpe:2.3:h:qualcomm:mdm9665:-:::::::* cpe:2.3:h:qualcomm:msm8909:-:::::::* cpe:2.3:h:qualcomm:msm8916:-:::::::* cpe:2.3:h:qualcomm:msm8952:-:::::::* cpe:2.3:h:qualcomm:sdx50:-:::::::* cpe:2.3:o:qualcomm:mdm9207_firmware:-:::::::* cpe:2.3:o:qualcomm:mdm9645_firmware:-:::::::* cpe:2.3:o:qualcomm:mdm9655_firmware:-:::::::* cpe:2.3:o:qualcomm:mdm9665_firmware:-:::::::* cpe:2.3:o:qualcomm:msm8909_firmware:-:::::::* cpe:2.3:o:qualcomm:msm8916_firmware:-:::::::* cpe:2.3:o:qualcomm:msm8952_firmware:-:::::::* cpe:2.3:o:qualcomm:sdx50_firmware:-:::::::*
Vendors & Products		Qualcomm mdm9207 Qualcomm mdm9207 Firmware Qualcomm mdm9645 Qualcomm mdm9645 Firmware Qualcomm mdm9655 Qualcomm mdm9655 Firmware Qualcomm mdm9665 Qualcomm mdm9665 Firmware Qualcomm msm8909 Qualcomm msm8909 Firmware Qualcomm msm8916 Qualcomm msm8916 Firmware Qualcomm msm8952 Qualcomm msm8952 Firmware Qualcomm sdx50 Qualcomm sdx50 Firmware

Tue, 22 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Qualcomm Qualcomm snapdragon
Vendors & Products		Qualcomm Qualcomm snapdragon

Tue, 22 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 22 Sep 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		Memory corruption while processing a crafted ELF file in the Primary Bootloader.
Title		Write-what-where Condition in Primary Bootloader
Weaknesses		CWE-123
References		https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html
Metrics		cvssV3_1 `{'score': 6.9, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

Subscriptions

Qualcomm Mdm9207 Mdm9207 Firmware Mdm9645 Mdm9645 Firmware Mdm9655 Mdm9655 Firmware Mdm9665 Mdm9665 Firmware Msm8909 Msm8909 Firmware Msm8916 Msm8916 Firmware Msm8952 Msm8952 Firmware Sdx50 Sdx50 Firmware Snapdragon

MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2026-09-22T09:45:18.539Z

Updated: 2026-09-22T10:15:27.877Z

Reserved: 2026-02-02T04:19:00.939Z

Link: CVE-2026-25262

Vulnrichment

Updated: 2026-09-22T10:14:24.141Z

NVD

Status : Analyzed

Published: 2026-09-22T10:17:08.973

Modified: 2026-10-06T15:34:57.523

Link: CVE-2026-25262

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-22T12:00:12Z

Weaknesses

CWE-123
Write-what-where Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Physical

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object