CVE-2026-25275 PUBLISHED

Buffer Over-read in WLAN Firmware

Assigner: qualcomm
Reserved: 02.02.2026 Published: 17.09.2026 Updated: 17.09.2026

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Qualcomm, Inc.
Product	Snapdragon
Versions	Default: unaffected Version Snapdragon G1 Gen 2 Gaming Platform is affected Version 5G Fixed Wireless Access Platform is affected Version AQT1000 is affected Version AR8031 is affected Version AR8035 is affected Version C110100 is affected Version Cologne is affected Version Congo is affected Version CQ2390M is affected Version CQ2390S is affected Version CQ7790 is affected Version CQ7790M is affected Version CQ8725S is affected Version CQ8750M is affected Version CQ8845S is affected Version CSR8811 is affected Version CSRA6620 is affected Version CSRA6640 is affected Version CSRB31024 is affected Version FastConnect 6200 is affected Version FastConnect 6700 is affected Version FastConnect 6800 is affected Version FastConnect 6900 is affected Version FastConnect 7800 is affected Version Flight RB5 5G Platform is affected Version FWA Gen 3 Ultra Platform is affected Version FWA Gen 5 Elite Platform is affected Version G1 Gen 1 is affected Version G2 Gen 1 is affected Version G3x Gen 2 is affected Version Immersive Home 214 Platform is affected Version Immersive Home 216 Platform is affected Version Immersive Home 316 Platform is affected Version Immersive Home 318 Platform is affected Version Immersive Home 3210 Platform is affected Version Immersive Home 326 Platform is affected Version IPQ5010 is affected Version IPQ5028 is affected Version IPQ5302 is affected Version IPQ5312 is affected Version IPQ5332 is affected Version IPQ6000 is affected Version IPQ6010 is affected Version IPQ6018 is affected Version IPQ8070 is affected Version IPQ8071 is affected Version IPQ8072 is affected Version IPQ8074 is affected Version IPQ8076 is affected Version IPQ8078 is affected Version IPQ9008 is affected Version IPQ9554 is affected Version IPQ9570 is affected Version IPQ9574 is affected Version IQ10 Series is affected Version IQ6 Series Platform is affected Version IQ8 Series Platform is affected Version IQ9 Series Platform is affected Version IQX5121 is affected Version IQX7181 is affected Version Kalpeni is affected Version Kobuk is affected Version LeMans_AU_LGIT is affected Version LeMansAU is affected Version Marina is affected Version MBM415 is affected Version MBM715 is affected Version Milos is affected Version Milos_IOT is affected Version Monaco_IOT is affected Version Netrani is affected Version Networking Pro 1200 Platform is affected Version Networking Pro 1210 Platform is affected Version Networking Pro 1610 Platform is affected Version Networking Pro 400 Platform is affected Version Networking Pro 600 Platform is affected Version Networking Pro 610 Platform is affected Version Networking Pro 800 Platform is affected Version Networking Pro 810 Platform is affected Version NPro A8 Elite Platform is affected Version Orne is affected Version Palawan25 is affected Version Pandeiro is affected Version PMP8074 is affected Version Q-4390 is affected Version Q-7790 is affected Version QAM8255P is affected Version QAM8295P is affected Version QAMSRV1H is affected Version QAMSRV1M is affected Version QCA0000 is affected Version QCA2062 is affected Version QCA2064 is affected Version QCA2065 is affected Version QCA2066 is affected Version QCA4024 is affected Version QCA6391 is affected Version QCA6420 is affected Version QCA6428 is affected Version QCA6430 is affected Version QCA6438 is affected Version QCA6554A is affected Version QCA6564AU is affected Version QCA6574 is affected Version QCA6574A is affected Version QCA6574AU is affected Version QCA6584AU is affected Version QCA6595 is affected Version QCA6595AU is affected Version QCA6678AQ is affected Version QCA6688AQ is affected Version QCA6696 is affected Version QCA6698AQ is affected Version QCA6698AU is affected Version QCA6777AQ is affected Version QCA6787AQ is affected Version QCA6797AQ is affected Version QCA8072 is affected Version QCA8075 is affected Version QCA8080 is affected Version QCA8081 is affected Version QCA8082 is affected Version QCA8084 is affected Version QCA8085 is affected Version QCA8337 is affected Version QCA8386 is affected Version QCA8695AU is affected Version QCA9888 is affected Version QCA9889 is affected Version QCC2070 is affected Version QCC2073 is affected Version QCC2076 is affected Version QCC6705 is affected Version QCC710 is affected Version QCF8000 is affected Version QCF8001 is affected Version QCM2290 is affected Version QCM4290 is affected Version QCM4325 is affected Version QCM4490 is affected Version QCM5430 is affected Version QCM6125 is affected Version QCM6490 is affected Version QCN5021 is affected Version QCN5022 is affected Version QCN5024 is affected Version QCN5052 is affected Version QCN5054 is affected Version QCN5064 is affected Version QCN5122 is affected Version QCN5124 is affected Version QCN5152 is affected Version QCN5154 is affected Version QCN5164 is affected Version QCN5550 is affected Version QCN6023 is affected Version QCN6024 is affected Version QCN6122 is affected Version QCN6132 is affected Version QCN6224 is affected Version QCN6274 is affected Version QCN6402 is affected Version QCN6412 is affected Version QCN6422 is affected Version QCN6432 is affected Version QCN7605 is affected Version QCN7606 is affected Version QCN9000 is affected Version QCN9001 is affected Version QCN9002 is affected Version QCN9003 is affected Version QCN9011 is affected Version QCN9012 is affected Version QCN9022 is affected Version QCN9024 is affected Version QCN9070 is affected Version QCN9100 is affected Version QCN9274 is affected Version QCS2290 is affected Version QCS4290 is affected Version QCS4490 is affected Version QCS6690 is affected Version QCS8550 is affected Version QFW7114 is affected Version QFW7124 is affected Version QLN1083BD is affected Version QLN1086BD is affected Version QMP1000 is affected Version QMP2001 is affected Version QPA1083BD is affected Version QPA1086BD is affected Version Qualcomm FastConnect 8800 Mobile Connectivity System is affected Version Qualcomm Video Collaboration VC1 Platform is affected Version Qualcomm Video Collaboration VC3 Platform is affected Version Qualcomm Video Collaboration VC5 Platform is affected Version QXM1083 is affected Version QXM1086 is affected Version QXM1093 is affected Version QXM1094 is affected Version QXM1095 is affected Version QXM1096 is affected Version Robotics RB2 Platform is affected Version Robotics RB5 Platform is affected Version SA4150P is affected Version SA4155P is affected Version SA510M is affected Version SA6145P is affected Version SA6150P is affected Version SA6155 is affected Version SA6155P is affected Version SA7255P is affected Version SA7775P is affected Version SA8145P is affected Version SA8150P is affected Version SA8155 is affected Version SA8155P is affected Version SA8195P is affected Version SA8255P is affected Version SA8295P is affected Version SA8620P is affected Version SA8770P is affected Version SA9000P is affected Version SAR1165P is affected Version SAR2130P is affected Version SC8380XP is affected Version SD 8 Gen1 5G is affected Version SD662 is affected Version SD865 5G is affected Version SDA660 is affected Version SDX65M is affected Version SDX81 is affected Version SM4850 is affected Version SM4850P is affected Version SM4875 is affected Version SM6225P is affected Version SM6250 is affected Version SM6450P is affected Version SM6475P is affected Version SM6475Q is affected Version SM6650P is affected Version SM6850 is affected Version SM7325P is affected Version SM7435 is affected Version SM7435P is affected Version SM7525 is affected Version SM7550 is affected Version SM7550P is affected Version SM7635P is affected Version SM7675 is affected Version SM7675P is affected Version SM7750P is affected Version SM8475P is affected Version SM8550P is affected Version SM8635 is affected Version SM8635P is affected Version SM8650Q is affected Version SM8735P is affected Version SM8750P is affected Version SM8845P is affected Version SM8950 is affected Version SM8950P is affected Version SM8975 is affected Version SM8975P is affected Version Smart Audio 400 Platform is affected Version Snapdragon 4 Gen 1 Mobile Platform is affected Version Snapdragon 4 Gen 2 Mobile Platform is affected Version Snapdragon 460 Mobile Platform is affected Version Snapdragon 480 5G Mobile Platform is affected Version Snapdragon 480+ 5G Mobile Platform is affected Version Snapdragon 6 Gen 1 Mobile Platform is affected Version Snapdragon 6 Gen 3 Mobile Platform is affected Version Snapdragon 6 Gen 4 Mobile Platform is affected Version Snapdragon 660 Mobile Platform is affected Version Snapdragon 662 Mobile Platform is affected Version Snapdragon 680 4G Mobile Platform is affected Version Snapdragon 685 4G Mobile Platform is affected Version Snapdragon 690 5G Mobile Platform is affected Version Snapdragon 695 5G Mobile Platform is affected Version Snapdragon 7 Gen 1 Mobile Platform is affected Version Snapdragon 7 Gen 4 Mobile Platform is affected Version Snapdragon 7+ Gen 2 Mobile Platform is affected Version Snapdragon 778G 5G Mobile Platform is affected Version Snapdragon 778G+ 5G Mobile Platform is affected Version Snapdragon 782G Mobile Platform is affected Version Snapdragon 7c Compute Platform is affected Version Snapdragon 7c Gen 2 Compute Platform "Rennell Pro" is affected Version Snapdragon 7c+ Gen 3 Compute is affected Version Snapdragon 7s Gen 3 Mobile Platform is affected Version Snapdragon 8 Elite is affected Version Snapdragon 8 Elite Gen 5 is affected Version Snapdragon 8 Gen 1 Mobile Platform is affected Version Snapdragon 8 Gen 2 Mobile Platform is affected Version Snapdragon 8 Gen 3 Mobile Platform is affected Version Snapdragon 8 Gen 5 is affected Version Snapdragon 8+ Gen 1 Mobile Platform is affected Version Snapdragon 8+ Gen 2 Mobile Platform is affected Version Snapdragon 865 5G Mobile Platform is affected Version Snapdragon 865+ 5G Mobile Platform is affected Version Snapdragon 870 5G Mobile Platform is affected Version Snapdragon 888 5G Mobile Platform is affected Version Snapdragon 888+ 5G Mobile Platform is affected Version Snapdragon 8c Compute Platform "Poipu Lite" is affected Version Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite" is affected Version Snapdragon 8cx Compute Platform is affected Version Snapdragon 8cx Compute Platform "Poipu Pro" is affected Version Snapdragon 8cx Gen 2 5G Compute Platform is affected Version Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro" is affected Version Snapdragon 8cx Gen 3 Compute Platform is affected Version Snapdragon AR1 Gen 1 Platform is affected Version Snapdragon AR1+ Gen 1 Platform is affected Version Snapdragon Auto 5G Modem-RF is affected Version Snapdragon Auto 5G Modem-RF Gen 2 is affected Version Snapdragon Ride Elite is affected Version Snapdragon W5+ Gen 1 Wearable Platform is affected Version Snapdragon X2 Elite is affected Version Snapdragon X35 5G Modem-RF System is affected Version Snapdragon X53 5G Modem-RF System is affected Version Snapdragon X55 5G Modem-RF System is affected Version Snapdragon X65 5G Modem-RF System is affected Version Snapdragon X72 5G Modem-RF System is affected Version Snapdragon X75 5G Modem-RF System is affected Version Snapdragon XR2 5G Platform is affected Version Snapdragon XR2+ Gen 1 Platform is affected Version SnapdragonAuto 4GModem is affected Version Snapdragon Cockpit Elite is affected Version Snapdragon Reality Elite Platform is affected Version SRV1H is affected Version SRV1M is affected Version SW-only is affected Version SW5100 is affected Version SW5100P is affected Version SXR2230P is affected Version SXR2250P is affected Version Trestles is affected Version Vision Intelligence 400 Platform is affected Version WCD9335 is affected Version WCD9340 is affected Version WCD9341 is affected Version WCD9360 is affected Version WCD9370 is affected Version WCD9371 is affected Version WCD9375 is affected Version WCD9378 is affected Version WCD9378C is affected Version WCD9380 is affected Version WCD9385 is affected Version WCD9390 is affected Version WCD9395 is affected Version WCN3910 is affected Version WCN3950 is affected Version WCN3980 is affected Version WCN3988 is affected Version WCN3990 is affected Version WCN6450 is affected Version WCN6650 is affected Version WCN6755 is affected Version WCN7760 is affected Version WCN7860 is affected Version WCN7861 is affected Version WCN7880 is affected Version WCN7881 is affected Version WCN8841 is affected Version WSA8810 is affected Version WSA8815 is affected Version WSA8830 is affected Version WSA8832 is affected Version WSA8835 is affected Version WSA8840 is affected Version WSA8845 is affected Version WSA8845H is affected Version WSA8850 is affected Version WSA8850W is affected Version WSA8855C is affected Version X1E80100 is affected Version XRV7209 is affected Version XRV9209 is affected

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html

Problem Types

CWE-126 Buffer Over-read CWE