CVE Field Guide
About Us
CVE-2026-25255
PUBLISHED
Exposed function in Qualcomm Package Manager and Qualcomm Software Center.
Assigner:
qualcomm
Reserved:
02.02.2026
Published:
22.09.2026
Updated:
22.09.2026
Exposed dangerous function lead to privilege escalation via gRPC server.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score:
8.8
CVSS score
8.8
Attack Vector
Local
Scope
Changed
Attack Complexity
Low
Confidentiality Impact
High
Privileges Required
Low
Integrity Impact
High
User Interaction
None
Availability Impact
High
CVSS 3.1
Product Status
Vendor
Qualcomm, Inc.
Product
Snapdragon
Versions
Default:
unaffected
Version QSCv1.17.1 is affected
Version QSCv1.19.1 is affected
Version QSCv1.21.0 is affected
Version QPMv3.0.125.4 is affected
Version QPMv3.0.126.7 is affected
Version QPMv3.0.127.2 is affected
References
https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html
Problem Types
CWE-749: Exposed Dangerous Method or Function
CWE