CVE-2026-25288: CWE-126 Buffer Over-read in Qualcomm, Inc. Snapdragon
CVE-2026-25288 is a high severity buffer over-read vulnerability (CWE-126) in Qualcomm Snapdragon products. It causes a transient denial of service (DoS) when processing a short target wake time channel usage response frame with insufficient packet size. The vulnerability affects multiple Snapdragon chipsets and related components. There is no vendor advisory or patch information currently available. The CVSS score is 7.4, indicating a high impact on availability without confidentiality or integrity impact.
AI Analysis
Technical Summary
This vulnerability involves a buffer over-read condition in Qualcomm Snapdragon devices when handling a specific type of network frame (target wake time channel usage response) that is shorter than expected. This causes a transient denial of service, disrupting device operation temporarily. The issue is classified under CWE-126 (Buffer Over-read). The affected products include a range of Qualcomm Snapdragon chipsets and wireless components such as CQ7790, QCM8838, QMB715, QMP1000, QXM1093 through QXM1096, SDR753, WCD9378 through WCD9395, WCN6755, WCN7860, WCN7861, WSA8840, WSA8845, XRV7209, and XRV9209. No official remediation or patch is currently documented, and no known exploits are reported in the wild.
Potential Impact
The vulnerability results in a transient denial of service condition, impacting the availability of affected Qualcomm Snapdragon devices. There is no impact on confidentiality or integrity. The transient DoS could disrupt normal device operation temporarily when processing malformed network frames.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is documented, monitor Qualcomm's advisories for updates. Avoid exposure to untrusted network frames if possible until a patch is available.
CVE-2026-25288: CWE-126 Buffer Over-read in Qualcomm, Inc. Snapdragon
Description
CVE-2026-25288 is a high severity buffer over-read vulnerability (CWE-126) in Qualcomm Snapdragon products. It causes a transient denial of service (DoS) when processing a short target wake time channel usage response frame with insufficient packet size. The vulnerability affects multiple Snapdragon chipsets and related components. There is no vendor advisory or patch information currently available. The CVSS score is 7.4, indicating a high impact on availability without confidentiality or integrity impact.
CVSS v3.1
Score 7.4high
Affected software
Qualcomm, Inc.
Snapdragon
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a buffer over-read condition in Qualcomm Snapdragon devices when handling a specific type of network frame (target wake time channel usage response) that is shorter than expected. This causes a transient denial of service, disrupting device operation temporarily. The issue is classified under CWE-126 (Buffer Over-read). The affected products include a range of Qualcomm Snapdragon chipsets and wireless components such as CQ7790, QCM8838, QMB715, QMP1000, QXM1093 through QXM1096, SDR753, WCD9378 through WCD9395, WCN6755, WCN7860, WCN7861, WSA8840, WSA8845, XRV7209, and XRV9209. No official remediation or patch is currently documented, and no known exploits are reported in the wild.
Potential Impact
The vulnerability results in a transient denial of service condition, impacting the availability of affected Qualcomm Snapdragon devices. There is no impact on confidentiality or integrity. The transient DoS could disrupt normal device operation temporarily when processing malformed network frames.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is documented, monitor Qualcomm's advisories for updates. Avoid exposure to untrusted network frames if possible until a patch is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- qualcomm
- Date Reserved
- 2026-02-02T04:19:00.942Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a72084dbf8831d5390c1570
Added to database: 08/04/2026, 15:42:05 UTC
Last enriched: 08/11/2026, 18:22:20 UTC
Last updated: 09/18/2026, 22:01:33 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.