Transient DOS: Short TWTA Frame Insufficient Packet - Qualcomm WiFi Subsystem
CVE-2026-25288 Published on August 4, 2026
Buffer Over-read in WLAN Firmware
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
Vulnerability Analysis
Weakness Type
Buffer Over-read
The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This typically occurs when the pointer or its index is incremented to a position beyond the bounds of the buffer or when pointer arithmetic results in a position outside of the valid memory location to name a few. This may result in exposure of sensitive information or possibly a crash.
Products Associated with CVE-2026-25288
Want to know whenever a new CVE is published for Qualcomm Snapdragon? stack.watch will email you.
Affected Versions
Qualcomm, Inc. Snapdragon:- Version Cologne is affected.
- Version CQ7790 is affected.
- Version FastConnect 6900 is affected.
- Version FastConnect 7800 is affected.
- Version Orne is affected.
- Version Palawan25 is affected.
- Version Pandeiro is affected.
- Version QCM8838 is affected.
- Version QLN1083BD is affected.
- Version QLN1086BD is affected.
- Version QMB715 is affected.
- Version QMP1000 is affected.
- Version QPA1083BD is affected.
- Version QPA1086BD is affected.
- Version QXM1093 is affected.
- Version QXM1094 is affected.
- Version QXM1095 is affected.
- Version QXM1096 is affected.
- Version SC8380XP is affected.
- Version SDR753 is affected.
- Version Snapdragon 7 Gen 4 Mobile Platform is affected.
- Version Snapdragon 8 Elite Gen 5 is affected.
- Version WCD9378 is affected.
- Version WCD9378C is affected.
- Version WCD9380 is affected.
- Version WCD9385 is affected.
- Version WCD9395 is affected.
- Version WCN6755 is affected.
- Version WCN7860 is affected.
- Version WCN7861 is affected.
- Version WSA8840 is affected.
- Version WSA8845 is affected.
- Version WSA8845H is affected.
- Version X2000077 is affected.
- Version X2000086 is affected.
- Version X2000090 is affected.
- Version X2000092 is affected.
- Version X2000094 is affected.
- Version XG101002 is affected.
- Version XG101032 is affected.
- Version XG101039 is affected.
- Version XRV7209 is affected.
- Version XRV9209 is affected.