CVE Intelligence
Analysis AI-assisted

CVE-2026-25293: Qualcomm PLC firmware incorrect authorization leading to buffer overflow

CVE-2026-25293 is a critical issue published by Qualcomm as CNA, described as a buffer overflow caused by incorrect authorization in PLC firmware and classified as CWE-863. NVD assigns a base score of 9.8 and other providers in the record list 9.6. The record shows no KEV listing, no confirmed exploitation in the sources consulted, and no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25293 was published by Qualcomm as CNA and is described as a buffer overflow due to incorrect authorization in PLC firmware. The weakness is mapped to CWE-863 (Incorrect Authorization).

Impact

  • NVD assigns a base score of 9.8 (critical), with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • Other providers listed in the record assign 9.6.
  • The record's SSVC data rates technical impact as total.

Affected products and versions

  • Qualcomm QCA7005 Firmware: the source does not specify affected versions.
  • Qualcomm Snapdragon: the record lists version QCA7005.
  • The record contains no fixed versions and no version boundaries.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none and automatable as no. The EPSS probability is 0.00182 with a percentile of 0.07335.

Remediation and mitigation

  • Review the Qualcomm May 2026 security bulletin for official guidance and any firmware updates.
  • Inventory devices that use QCA7005 firmware or Snapdragon products referencing this model.
  • As a general defensive measure, restrict network exposure of PLC-related interfaces until vendor guidance is confirmed.

Detection guidance

  • Watch affected devices for unexpected crashes, resets or firmware behavior.
  • Review logs for unusual traffic to management or PLC communication interfaces.

Limitations of the available information

  • The record does not list affected or fixed firmware versions.
  • The mapping of the PLC firmware in the description to the QCA7005 firmware entry is an inference.
  • The contents of the vendor bulletin were not available in the record, so remediation details cannot be confirmed here.

Frequently asked questions

Is CVE-2026-25293 known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none.

Which versions are affected?

The source does not specify affected firmware versions for Qualcomm QCA7005 Firmware, and the record contains no version boundaries to report.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.