This vulnerability (CVE-2026-25258) is classified as CWE-125 (Out-of-bounds Read) and occurs in Qualcomm Snapdragon products. It arises from memory corruption triggered by processing IOCTL calls related to escape operations. The vulnerability affects a broad range of Snapdragon components and chipsets, including Cologne, FastConnect 6900 and 7800, QCA0000, SC8380XP, WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845, WSA8845H, and several X-series versions. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges, but results in high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability could lead to memory corruption via out-of-bounds reads, potentially allowing an attacker with local access to compromise confidentiality, integrity, and availability of the affected system components. The high CVSS score reflects the severity of these impacts. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided by Qualcomm, monitor for vendor updates. Until a fix is available, restrict local access to trusted users and environments to reduce risk.