CVE-2026-25266

Exposed dangerous function in windows host

State: Published
Severity: 5.5 Medium
Published: May 4, 2026
Updated: May 4, 2026
Reserved: Feb 2, 2026

Description

Memory corruption while processing IOCTL command when device is in power-save state.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	qualcomm

Weaknesses

CWE-749 Exposed Dangerous Method or Function

Affected Products

Product	Versions
SnapdragonQualcomm, Inc.	CologneAffected FastConnect 6900Affected FastConnect 7800Affected SC8380XPAffected Snapdragon AR1 Gen 1 PlatformAffected WCD9378CAffected WCD9380Affected WCD9385Affected WCN7861Affected WCN7880Affected WSA8830Affected WSA8832Affected WSA8835Affected WSA8840Affected WSA8845Affected WSA8845HAffected X2000077Affected X2000086Affected X2000090Affected X2000092Affected X2000094Affected XG101002Affected XG101032Affected XG101039Affected

Product

Versions

SnapdragonQualcomm, Inc.

CologneAffected
FastConnect 6900Affected
FastConnect 7800Affected
SC8380XPAffected
Snapdragon AR1 Gen 1 PlatformAffected
WCD9378CAffected
WCD9380Affected
WCD9385Affected
WCN7861Affected
WCN7880Affected
WSA8830Affected
WSA8832Affected
WSA8835Affected
WSA8840Affected
WSA8845Affected
WSA8845HAffected
X2000077Affected
X2000086Affected
X2000090Affected
X2000092Affected
X2000094Affected
XG101002Affected
XG101032Affected
XG101039Affected

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.