{"id":"CVE-2026-25267","published":"2026-10-06T07:16:56.997","lastModified":"2026-10-09T14:10:26.887","description":"Memory corruption when non-secure loader rewrites page tables before secure memory initialization.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":["qualcomm"],"products":["qca6698au firmware","qca6698au","qca6797aq firmware","qca6797aq","qcc710 firmware","qcc710","qcm2290 firmware","qcm2290","qcm4290 firmware","qcm4290","qcm4325 firmware","qcm4325"],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A memory corruption vulnerability exists in Qualcomm's secure boot process where a non-secure loader can rewrite page tables before secure memory initialization, potentially allowing attackers to execute arbitrary code with elevated privileges. This flaw occurs during firmware loading and can lead to complete system compromise.","exploitability":"Exploitation requires local access with non-secure privileges and specific timing during the boot process, making it moderately difficult but possible for attackers who can execute code on the device before secure initialization completes.","blast_radius":"If exploited, this vulnerability could affect all Qualcomm-based devices using the affected firmware versions (qca6698au, qca6797aq, qcc710, qcm2290) and potentially allow attackers to gain full system control during boot-up.","remediation":"Upgrade to firmware version 2.590 or later for all affected Qualcomm devices including qca6698au, qca6797aq, qcc710, and qcm2290 models.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["boot","memory-corruption","firmware"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:56:34.422Z"}}