Monthly
A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. No public exploit code and no CISA KEV activity were identified at time of analysis, and the impact is bounded: the independent assessment rates it confidentiality-low/availability-low (CVSS 3.1 base 6.x-equivalent) rather than the vendor's confidentiality-high score, since the over-read leaks a small amount of adjacent memory rather than yielding arbitrary disclosure or code execution.
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. There is no confirmed active exploitation (CISA SSVC: Exploitation = none) and no public exploit code identified at time of analysis, though CISA rates the issue Automatable = yes and Technical Impact = partial.
An out-of-bounds read in libXtst's RECORD reply parser (CWE-126) allows a malicious or compromised X server to crash attached X clients that link the library and use the XTEST/RECORD extension, affecting all versions before 1.2.6. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, meaning unauthenticated attackers in the network position of the rogue server can trigger a low-integrity information leak and a denial of service, but only if the victim voluntarily connects to that server (UI:R). This is a reverse-trust scenario: it is not exploitable against clients that connect only to trusted local or remote X servers, and the X server itself is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; vendor patch data indicates a fix is available, with the upstream correction landing in the libXtst 1.2.6 line.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.
A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. No public exploit code and no CISA KEV activity were identified at time of analysis, and the impact is bounded: the independent assessment rates it confidentiality-low/availability-low (CVSS 3.1 base 6.x-equivalent) rather than the vendor's confidentiality-high score, since the over-read leaks a small amount of adjacent memory rather than yielding arbitrary disclosure or code execution.
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. There is no confirmed active exploitation (CISA SSVC: Exploitation = none) and no public exploit code identified at time of analysis, though CISA rates the issue Automatable = yes and Technical Impact = partial.
An out-of-bounds read in libXtst's RECORD reply parser (CWE-126) allows a malicious or compromised X server to crash attached X clients that link the library and use the XTEST/RECORD extension, affecting all versions before 1.2.6. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, meaning unauthenticated attackers in the network position of the rogue server can trigger a low-integrity information leak and a denial of service, but only if the victim voluntarily connects to that server (UI:R). This is a reverse-trust scenario: it is not exploitable against clients that connect only to trusted local or remote X servers, and the X server itself is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; vendor patch data indicates a fix is available, with the upstream correction landing in the libXtst 1.2.6 line.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.