CVE-2026-25281: Allocation of Resources Without Limits or Throttling in OOBM
Published Sep 17, 2026
·Updated
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
Affected Software
14 affected components
All of the following
Qualcomm Cologne Firmware
Qualcomm Cologne
All of the following
Qualcomm Fastconnect 7800 Firmware
Qualcomm Fastconnect 7800
All of the following
Qualcomm Snapdragon X2 Elite Firmware
Qualcomm Snapdragon X2 Elite
All of the following
Qualcomm Wcd9378c Firmware
Qualcomm Wcd9378c
All of the following
Qualcomm Wsa8840 Firmware
Qualcomm Wsa8840
All of the following
Qualcomm Wsa8845 Firmware
Qualcomm Wsa8845
All of the following
Qualcomm Wsa8845h Firmware
Qualcomm Wsa8845h
Event History
Sep 17, 2026
CVE Published
via MITRE·04:11 AM
Data Sourced
via MITRE·04:11 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to trigger the denial of service?
The vector is adjacent network and requires no privileges or user interaction. An attacker would need to be able to send requests to the affected OOBM component over an adjacent-network path.
2
What is the expected impact of successful exploitation?
The described impact is a transient denial of service caused by processing large or numerous request buffers without sufficient memory allocation validation. The supplied metrics indicate availability impact, with no stated confidentiality or integrity impact.