CVE-2026-25262: Write-what-where Condition in Primary Bootloader
Published Sep 22, 2026
·Updated
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
Affected Software
17 affected components
Qualcomm Primary Bootloader
All of the following
Qualcomm Mdm9207 Firmware
Qualcomm Mdm9207
All of the following
Qualcomm Mdm9655 Firmware
Qualcomm MDM9655
All of the following
Qualcomm Mdm9665 Firmware
Qualcomm Mdm9665
All of the following
Qualcomm Msm8909 Firmware
Qualcomm MSM8909
All of the following
Qualcomm Msm8916 Firmware
Qualcomm Msm8916
All of the following
Qualcomm Msm8952 Firmware
Qualcomm MSM8952
All of the following
Qualcomm Sdx50 Firmware
Qualcomm Sdx50
All of the following
Qualcomm Mdm9645 Firmware
Qualcomm MDM9645
Event History
Sep 22, 2026
CVE Published
via MITRE·09:45 AM
Data Sourced
via MITRE·09:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access and interaction does exploitation require?
The supplied vector indicates physical access, low privileges, required user interaction, and high attack complexity. Exploitation involves processing a crafted ELF file in the Primary Bootloader.
2
What is the potential security impact if exploitation succeeds?
The supplied vector rates confidentiality, integrity, and availability impact as high, with scope changed.
3
Which products or versions are affected?
The provided information does not identify affected products, chipset models, or software versions.