This vulnerability (CVE-2026-25289) involves a stack-based buffer overflow (CWE-121) in Qualcomm Snapdragon devices. The flaw is triggered by processing Device Capability Extended attributes in NAN Service Discovery Frames that contain invalid length values, leading to memory corruption. The vulnerability affects a wide range of Qualcomm Snapdragon versions identified explicitly by model numbers. The CVSS 3.1 score of 9.6 reflects its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. As of the published date, no patch or official remediation level has been provided by Qualcomm.

Successful exploitation of this vulnerability could allow an attacker to cause memory corruption resulting in a stack-based buffer overflow. This can lead to complete compromise of confidentiality, integrity, and availability of the affected device. The vulnerability is exploitable remotely over the network without privileges or user interaction, making it highly dangerous. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Qualcomm's advisories for updates. Until a patch is available, avoid processing untrusted NAN Service Discovery Frames or disable related functionality if possible.