EUVD-2025-210022
GHSA-4728-c4x2-h2qm
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (qualcomm) · only source for this CVE.
CVSS VectorVendor: qualcomm
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
AnalysisAI
Qualcomm Snapdragon chipsets improperly parse 802.11 advertisement frames containing malformed MBSSID (Multiple BSSID) elements of insufficient length, triggering a buffer over-read that discloses memory contents to an attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C) indicates network-reachable exploitation with changed scope, meaning the impact crosses beyond the Wi-Fi subsystem into adjacent components. No public exploit identified at time of analysis, and no CISA KEV listing exists; Qualcomm addressed this in their June 2026 Security Bulletin.
Technical ContextAI
The MBSSID (Multiple Basic Service Set Identifier) element is an IEEE 802.11ax (Wi-Fi 6) feature enabling a single physical access point to advertise multiple virtual BSSIDs within a single beacon or probe response frame. The affected Qualcomm Snapdragon Wi-Fi firmware or driver code (CPE: cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*) fails to validate that the declared length of an MBSSID element matches the actual data present before reading from it. This produces a CWE-126 (Buffer Over-read) condition: the parser reads beyond the end of the element's allocated buffer, potentially exposing adjacent heap or stack memory. The 'Buffer Overflow' tag in the intelligence source may reflect the broader vulnerability class or a related write-path issue, but the CWE-126 root cause is a read-side overrun, consistent with the Information Disclosure primary impact. Changed scope (S:C) in the CVSS vector suggests that the leaked data or the over-read itself can affect components outside the immediate Wi-Fi parsing component, such as the OS networking stack or application-layer security boundaries.
RemediationAI
The primary remediation is to apply the patches released by Qualcomm in the June 2026 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html). Exact patched firmware or driver versions are not independently confirmed from the available CPE data - the bulletin should be consulted for device-specific fix versions. OEM device manufacturers who integrate Snapdragon chipsets must incorporate and distribute these patches via their own firmware update mechanisms; end users should apply any available device firmware or OS updates from their device vendor. As a compensating control where patching is not immediately available, restricting device operation to trusted wireless environments reduces exposure to crafted beacon frames - specifically, disabling automatic Wi-Fi scanning or passive frame processing in untrusted public environments limits the attack surface, though this significantly degrades usability. There is no indication of a simpler configuration-level workaround such as disabling MBSSID support independently. No vendor advisory beyond the Qualcomm bulletin has been identified at time of analysis.
More in Snapdragon
View allMemory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker t
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable lim
Local privilege escalation via memory corruption affects Qualcomm Snapdragon platforms, where allocating memory with siz
Same weakness CWE-126 – Buffer Over-read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today