Secuno
ENNL
Book demo

CVE-2026-25289

Qualcomm Ar8035 Firmware buffer overflow

9.6 CRITICALEPSS 0.19%
  1. Published4 Aug 2026

Description

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

CVSS 3.1 breakdown

Attack vectorAdjacent
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Qualcomm Ar8035 Firmwareall versions
Qualcomm Cologne Firmwareall versions
Qualcomm Cq7790 Firmwareall versions
Qualcomm Cq8725s Firmwareall versions
Qualcomm Cq8750m Firmwareall versions
Qualcomm Fastconnect 6200 Firmwareall versions
Qualcomm Fastconnect 6700 Firmwareall versions
Qualcomm Fastconnect 6900 Firmwareall versions
Qualcomm Fastconnect 7800 Firmwareall versions
Qualcomm Fwa Gen 3 Ultra Firmwareall versions
Qualcomm Fwa Gen 5 Elite Firmwareall versions
Qualcomm G2 Gen 1 Firmwareall versions
Qualcomm G3x Gen 2 Firmwareall versions
Qualcomm Immersive Home 3210 Platform Firmwareall versions
Qualcomm Immersive Home 326 Platform Firmwareall versions
Qualcomm Ipq5300 Firmwareall versions
Qualcomm Ipq5302 Firmwareall versions
Qualcomm Ipq5312 Firmwareall versions
Qualcomm Ipq5332 Firmwareall versions
Qualcomm Ipq9008 Firmwareall versions
Qualcomm Ipq9554 Firmwareall versions
Qualcomm Ipq9570 Firmwareall versions
Qualcomm Ipq9574 Firmwareall versions
Qualcomm Iqx5121 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10910910.0
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability…
CVE-2026-854578.1
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to…
CVE-2026-962668.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…
CVE-2026-962648.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…
CVE-2026-962638.2
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,…
CVE-2026-962628.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…

Frequently asked

Is CVE-2026-25289 being actively exploited?

CVE-2026-25289 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.19%.

How severe is CVE-2026-25289?

CVE-2026-25289 has a CVSS 3.1 base score of 9.6, rated critical. EPSS estimates a 0.19% probability of exploitation.

Which products are affected by CVE-2026-25289?

Affected products include Qualcomm Ar8035 Firmware, Qualcomm Cologne Firmware, Qualcomm Cq7790 Firmware, Qualcomm Cq8725s Firmware, Qualcomm Cq8750m Firmware, and 19 more.

How do I fix CVE-2026-25289?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-25289 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.