Quick answers
- Is CVE-2026-25259 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-25259 being exploited in the wild.
- How severe is CVE-2026-25259?
- High severity, with a CVSS score of 7.8, published 1 June 2026.
- Which products and versions are affected?
- Qualcomm Snapdragon Mobile.
- Is there a fix for CVE-2026-25259?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-25259 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-25259?
- Check whether you run Qualcomm Snapdragon Mobile. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A memory corruption vulnerability, specifically an out-of-bounds write (CWE-787), exists in Qualcomm chipset firmware/drivers. The issue occurs during the processing of multiple Input/Output Control (IOCTL) commands for 'escape' operations. A local attacker with low privileges can trigger this flaw by sending crafted IOCTL requests to the driver. Successful exploitation can lead to arbitrary code execution with elevated privileges, data confidentiality breaches, or a complete system denial of service. The vulnerability was addressed in the Qualcomm June 2026 security bulletin.
Affected products
- Qualcomm Snapdragon Mobile
Timeline
- 2026-06-01: advisory: Qualcomm published the June 2026 security bulletin.
- 2026-06-01: disclosed: CVE-2026-25259 was published to the NVD.