CVE-2026-25294: Qualcomm transient denial of service while parsing frame during channel usage
CVE-2026-25294 · Severity: high · CVSS 7.4 · Published 2026-09-17
A Qualcomm component used for wireless communication exhibits a denial of service vulnerability during frame parsing operations on communication channels. An attacker can trigger a transient service disruption by sending specially crafted frames, temporarily impacting system availability without requiring authentication.
No. Junglewise Threat Intelligence has no report of CVE-2026-25294 being exploited in the wild.
How severe is CVE-2026-25294?
High severity, with a CVSS score of 7.4, published 17 September 2026.
Which products and versions are affected?
Qualcomm <UNKNOWN>.
Is there a fix for CVE-2026-25294?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25294 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-25294?
Check whether you run Qualcomm Cologne, Qualcomm Cologne Firmware, Qualcomm Congo or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a denial of service condition triggered during frame parsing operations within Qualcomm wireless communication components. The root cause lies in insufficient input validation or error handling when processing network frames on active communication channels. An attacker can exploit this by sending malformed or specially crafted frames over the network without requiring authentication, causing the affected component to enter a transient error state that disrupts service availability. The impact is limited to temporary availability loss rather than data compromise or privilege escalation. A patch is expected from Qualcomm through their security bulletin.