CVE-2026-25267

Summary

A memory corruption vulnerability exists in Qualcomm's secure boot process where a non-secure loader can rewrite page tables before secure memory initialization, potentially allowing attackers to execute arbitrary code with elevated privileges. This flaw occurs during firmware loading and can lead to complete system compromise.

Exploitability

Exploitation requires local access with non-secure privileges and specific timing during the boot process, making it moderately difficult but possible for attackers who can execute code on the device before secure initialization completes.

Blast radius

If exploited, this vulnerability could affect all Qualcomm-based devices using the affected firmware versions (qca6698au, qca6797aq, qcc710, qcm2290) and potentially allow attackers to gain full system control during boot-up.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later for all affected Qualcomm devices including qca6698au, qca6797aq, qcc710, and qcm2290 models.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.