Security Vulnerability Report
中文
CVE-2026-25266 CVSS 5.5 MEDIUM

CVE-2026-25266

Published: 2026-05-04 17:16:22
Last Modified: 2026-05-06 18:02:02

Description

Memory corruption while processing IOCTL command when device is in power-save state.

CVSS Details

CVSS Score
5.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_firmware:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1:-:*:*:*:*:*:*:* - NOT VULNERABLE
Qualcomm 受影响组件 (参考2026年5月安全公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
/* * PoC for CVE-2026-25266 * Conceptual demonstration of triggering memory corruption via IOCTL. * Compile: gcc poc.c -o poc */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> // Define the vulnerable IOCTL command (hypothetical value) #define VULNERABLE_IOCTL 0x8001 int main() { int fd; char buffer[1024]; // Open the device file (path is hypothetical) fd = open("/dev/vulnerable_device", O_RDWR); if (fd < 0) { perror("Failed to open device"); return -1; } printf("Sending malicious IOCTL to trigger memory corruption...\n"); // Send the IOCTL command while device is in power-save state // In a real scenario, specific buffer content would trigger the corruption if (ioctl(fd, VULNERABLE_IOCTL, buffer) < 0) { perror("IOCTL failed"); } else { printf("IOCTL sent successfully. Device might crash.\n"); } close(fd); return 0; }

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-25266", "sourceIdentifier": "[email protected]", "published": "2026-05-04T17:16:22.107", "lastModified": "2026-05-06T18:02:02.110", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory corruption while processing IOCTL command when device is in power-save state."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-749"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*", "matchCriteriaId": "E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E670F500-9B71-4BBE-B5DA-221D35803C89"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*", "matchCriteriaId": "9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*", "matchCriteriaId": "638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*", "matchCriteriaId": "FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "A69D9315-2233-4C4E-8651-8E32C4BA5866"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1:-:*:*:*:*:*:*:*", "matchCriteriaId": "27DFA1D7-0459-401A-9E00-A5E700AC9C9F"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*", "matchCriteriaId": "91B32C89-3238-4FDF-BB3F-F6BAE829769B"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "70292B01-617F-44AD-AF77-1AFC1450523D"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*", "matchCriteriaId": "FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "92B17201-8185-47F1-9720-5AB4ECD11B22"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*", "matchCriteriaId": "E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]}, {"oper ... (truncated)