{"id":"CVE-2026-25291","published":"2026-10-06T07:16:57.893","lastModified":"2026-10-09T14:11:39.610","description":"Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":["qualcomm"],"products":["sar1165p firmware","sar1165p","sc8380xp firmware","sc8380xp","snapdragon 662 mobile platform firmware","snapdragon 662 mobile platform","sm4875 firmware","sm4875","sm6225p firmware","sm6225p","sm6850 firmware","sm6850"],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","tags":["Vendor Advisory","Patch"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a memory corruption vulnerability in Qualcomm's SAR1165P and SC8380XP firmware components that occurs during concurrent operations on shared memory page lists due to insufficient synchronization. This allows an authenticated attacker with local access to potentially execute arbitrary code or cause system instability.","exploitability":"Exploitation requires local authentication and is moderately difficult, needing precise timing of concurrent memory operations to trigger the race condition that leads to memory corruption.","blast_radius":"If exploited, this vulnerability could affect Snapdragon 662 mobile platform devices and other Qualcomm-based systems running the affected firmware versions, potentially leading to complete system compromise or denial of service.","remediation":"Upgrade to firmware version 2.590 or later for the affected Snapdragon 662 mobile platform and related Qualcomm components.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["memory-corruption","firmware","local-privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:56:24.966Z"}}