CVE-2026-25263: CWE-787: Out-of-bounds Write in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25263) involves a memory corruption issue in Qualcomm Snapdragon chipsets triggered by processing IOCTL commands from user space with invalid parameters. The flaw is classified as CWE-787 (Out-of-bounds Write). It affects numerous Snapdragon versions, including CQ7790, MBM415, QCA series, QCM series, SD series, WCD series, WCN series, WSA series, and others as explicitly listed. The CVSS v3.1 base score is 6.6, reflecting a medium severity with attack vector local, high attack complexity, low privileges required, and user interaction needed. The impact includes partial confidentiality loss, high integrity impact, and low availability impact. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation can cause memory corruption leading to partial loss of confidentiality, high integrity compromise, and low availability impact on affected Snapdragon devices. The attack requires local access with user interaction and has high complexity, limiting exploitability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are available, restrict local access and avoid executing untrusted IOCTL commands. Monitor Qualcomm's advisories for updates on patches or mitigations.