# CVE-2026-25282: Qualcomm component out-of-bounds memory access in data processing

Source: https://junglewise.ai/threats/cve-2026-25282-qualcomm-component-out-of-bounds-memory-access-in-data-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-25282 · Severity: high · CVSS 7.9 · Published 2026-09-17

A Qualcomm component fails to validate data received from neighboring systems, leading to an out-of-bounds memory access. This vulnerability can cause temporary service disruptions or crashes, affecting the availability of connected devices or systems that rely on this component.

Technologies: [Qualcomm Cologne](https://junglewise.ai/threats/technologies/cologne), [Qualcomm Cologne Firmware](https://junglewise.ai/threats/technologies/cologne-firmware), [Qualcomm Fastconnect 7800](https://junglewise.ai/threats/technologies/fastconnect-7800), [Qualcomm Fastconnect 7800 Firmware](https://junglewise.ai/threats/technologies/fastconnect-7800-firmware), [Qualcomm Snapdragon X2 Elite](https://junglewise.ai/threats/technologies/snapdragon-x2-elite), [Qualcomm Snapdragon X2 Elite Firmware](https://junglewise.ai/threats/technologies/snapdragon-x2-elite-firmware), [Qualcomm Wcd9378c](https://junglewise.ai/threats/technologies/wcd9378c), [Qualcomm Wcd9378c Firmware](https://junglewise.ai/threats/technologies/wcd9378c-firmware), [Qualcomm Wsa8840](https://junglewise.ai/threats/technologies/wsa8840), [Qualcomm Wsa8840 Firmware](https://junglewise.ai/threats/technologies/wsa8840-firmware), [Qualcomm Wsa8845](https://junglewise.ai/threats/technologies/wsa8845), [Qualcomm Wsa8845 Firmware](https://junglewise.ai/threats/technologies/wsa8845-firmware), [Qualcomm Wsa8845h](https://junglewise.ai/threats/technologies/wsa8845h), [Qualcomm Wsa8845h Firmware](https://junglewise.ai/threats/technologies/wsa8845h-firmware). Vendors: [Qualcomm](https://junglewise.ai/threats/vendors/qualcomm).

## Quick answers

**Is CVE-2026-25282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25282 being exploited in the wild.

**How severe is CVE-2026-25282?** High severity, with a CVSS score of 7.9, published 17 September 2026.

**Which products and versions are affected?** Qualcomm <UNKNOWN>.

**Is there a fix for CVE-2026-25282?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25282 attacked?** It is attacked from the adjacent network or over the network, in device firmware.

**Am I affected by CVE-2026-25282?** Check whether you run Qualcomm Cologne, Qualcomm Cologne Firmware, Qualcomm Fastconnect 7800 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds memory access (CWE-119 or similar) in Qualcomm firmware or software that processes unverified data from adjacent systems. The root cause is insufficient input validation of network or inter-system communication data. The attack vector is adjacent/network-accessible, requiring data from a neighboring system to trigger the out-of-bounds read or write. An attacker can cause a denial of service through transient crashes; code execution may also be possible depending on memory layout and the nature of the out-of-bounds access. Patches are expected from Qualcomm as part of their security bulletin cycle.

## Affected products

- Qualcomm <UNKNOWN>

## Timeline

- 2026-09-17: disclosed

## References

- [https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html](https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html)

## Related threats

- [Qualcomm transient denial of service while parsing frame during channel usage](https://junglewise.ai/threats/cve-2026-25294-qualcomm-transient-denial-of-service-while-parsing-frame-during)
- [Qualcomm component memory corruption in buffer validation](https://junglewise.ai/threats/cve-2026-25290-qualcomm-component-memory-corruption-in-buffer-validation)
- [Qualcomm component use-after-free information disclosure](https://junglewise.ai/threats/cve-2026-25284-qualcomm-component-use-after-free-information-disclosure)
- [Qualcomm buffer overflow in external data handling](https://junglewise.ai/threats/cve-2026-25283-qualcomm-buffer-overflow-in-external-data-handling)
- [Qualcomm component memory corruption in escape handling](https://junglewise.ai/threats/cve-2026-25280-qualcomm-component-memory-corruption-in-escape-handling)