Critical Qualcomm Chipset Flaws Let Attackers Remotely Execute Code

Key Takeaways

• Qualcomm has disclosed multiple critical vulnerabilities across its chipsets and software, affecting a wide range of devices.
• The most severe flaws, CVE-2026-25254 and CVE-2026-25293, enable unauthenticated remote code execution with CVSS scores of 9.8 and 9.6, respectively.
• Affected hardware spans consumer mobile devices, smart home products, and automotive systems using Snapdragon processors.
• Patches have been provided to Original Equipment Manufacturers (OEMs), who are responsible for distributing updates to end-users.

Qualcomm Discloses Critical Remote Code Execution Flaws Affecting Broad Hardware Ecosystem

Qualcomm Technologies has issued a critical security bulletin, revealing a series of severe vulnerabilities within both its proprietary and open-source software stacks. These disclosures highlight significant risks to a vast array of devices powered by Snapdragon processors, necessitating urgent security updates across the ecosystem.

The primary concern centers on high-impact vulnerabilities that could allow malicious actors to achieve arbitrary code execution remotely, posing a substantial threat to system integrity and user data.

Deep Dive into Critical Vulnerabilities

The most alarming vulnerability, identified as CVE-2026-25254, carries a critical CVSS score of 9.8. This flaw resides in the Qualcomm Software Center and stems from inadequate authorization mechanisms. It permits an unauthenticated attacker to execute code remotely through the SocketIO interface, bypassing standard security protocols.

Another severe remote code execution vulnerability, CVE-2026-25293, rated 9.6 on the CVSS scale, impacts the Power Line Communication (PLC) firmware. This vulnerability is a buffer overflow issue, triggered by faulty authorization checks. The remote nature of these vulnerabilities, coupled with the absence of any user interaction requirements for exploitation, makes them particularly attractive targets for threat actors aiming for silent system compromise.

Wider Scope of High-Severity Issues

Beyond the critical RCE vulnerabilities, Qualcomm has also addressed several high-severity issues that could lead to local privilege escalation or system instability. For instance, CVE-2026-25262 describes a write-what-where condition within the Primary Bootloader, which could result in memory corruption when processing specially crafted ELF files.

Furthermore, vulnerabilities in the WLAN HAL and firmware, specifically CVE-2025-47401 and CVE-2025-47403, could allow remote attackers to instigate temporary Denial-of-Service (DoS) conditions. These are caused by buffer overruns during critical operations like channel configuration or wireless roaming.

Affected Products and Ecosystem Impact

The breadth of these vulnerabilities is extensive, impacting hundreds of chipsets across both consumer and enterprise hardware. Compromised devices range from older modem technologies to the newest flagship mobile processors, including platforms such as the Snapdragon 8 Elite, Snapdragon 8 Gen 3, and FastConnect 7800. Additionally, automotive infrastructure relying on Snapdragon Auto 5G Modems and various smart home networking products are also susceptible to these exploits.

The complete list of CVEs addressed in the Qualcomm security bulletin includes:

• CVE-2026-25254: Improper authorization in Qualcomm Software Center (CVSS 9.8).
• CVE-2026-25293: Buffer overflow in Power Line Communication Firmware (CVSS 9.6).
• CVE-2026-25255: Exposed dangerous function in Qualcomm Software Center (CVSS 8.8).
• CVE-2025-47408: Untrusted pointer dereference in WINBLAST-POWER (CVSS 7.8).
• CVE-2025-47405: Untrusted pointer dereference in Camera (CVSS 7.8).
• CVE-2025-47407: Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8).
• CVE-2026-24082: Use After Free in Automotive GPU (CVSS 7.8).
• CVE-2026-25262: Write-what-where condition in Primary Bootloader (CVSS 6.9).
• CVE-2025-47401: Buffer over-read in WLAN HAL (CVSS 6.5).
• CVE-2025-47403: Buffer over-read in WLAN Firmware (CVSS 6.5).
• CVE-2025-47404: Buffer copy without checking the size of input in Automotive Audio (CVSS 6.5).
• CVE-2025-47406: Buffer over-read in DSP Service (CVSS 6.1).
• CVE-2026-25266: Exposed dangerous function in Windows WLAN Host (CVSS 5.5).

What You Should Do

Qualcomm has already distributed security patches for these vulnerabilities to its Original Equipment Manufacturers (OEMs). Since Qualcomm does not directly deliver updates to end-user devices, the responsibility for deploying these essential fixes lies with device manufacturers, including smartphone brands, router producers, and automotive companies. Recent Android security updates have begun to integrate patches for various Qualcomm components, highlighting the critical need for rapid deployment.

• Apply Updates Immediately: End-users should promptly install the latest firmware and security updates provided by their device manufacturers.
• Identify Affected Assets: Cybersecurity professionals must prioritize identifying all affected hardware and systems within their organizational infrastructure.
• Implement Network Monitoring: Until all patches are fully deployed across endpoints, organizations should enhance network-level monitoring to detect any anomalous traffic that might indicate attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.