EUVD-2025-209628Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A because the malformed FT frame is delivered over-the-air within WiFi range during roaming, not internet-routable; no auth or interaction needed; availability-only transient DoS.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionNVD
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
AnalysisAI
A malformed 802.11r Fast Transition (FT) response frame with an invalid header structure can cause a transient denial of service in the WLAN firmware of a very broad range of Qualcomm Snapdragon chipsets, including Snapdragon Mobile Platforms, FastConnect connectivity combos, QCA/QCN WLAN parts, Networking Pro and Immersive Home platforms, and several 5G Modem-RF systems. The victim device must be actively performing Fast BSS Transition wireless roaming, and the attacker must be within WiFi radio range - typically by operating or impersonating an access point - so exploitation requires local radio proximity rather than internet-reachable access, and the resulting impact is a self-recovering outage with no confidentiality or integrity effect. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and the EPSS score is negligible (0.02%, 3rd percentile), with CISA's SSVC framework rating exploitation as "none" and automatable as "no"; the vendor assigns 7.5 (HIGH) while our independent assessment lowers the effective vector to AV:A because of the radio-proximity requirement.
Technical ContextAI
The issue sits in the WLAN firmware's parsing of IEEE 802.11r Fast BSS Transition (FT) management frames, the mechanism that accelerates hand-off between access points in the same mobility domain (FT Authentication and FT Action/Response exchanges). A crafted FT response whose header structure is invalid drives an out-of-bounds read in the frame-processing path, classified by the vendor as CWE-126 (Buffer Over-read) - note that the accompanying intelligence tag says "Buffer Overflow," so the tag and the CWE disagree and the read-versus-write distinction should be treated as unfixed until Qualcomm's bulletin text is reviewed. An over-read in this path typically manifests as a firmware assertion, crash, or reset rather than memory corruption with control-flow consequences, which matches the "transient DOS" framing and the SSVC technical-impact rating of "partial." The underlying technology is the Wi-Fi driver/offload firmware in Qualcomm connectivity silicon (QCA/QCN WLAN chips, FastConnect 6200/6700/6900/7800, IPQ-series networking SoCs, and the WLAN blocks integrated into Snapdragon mobile, compute, and modem platforms); the supplier CPE is generic (cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:*), which is why the affected list is so sprawling. The assessment divergence on vector (vendor AV:N versus assessed AV:A) is important: a frame-injection attack is not remotely routable and cannot be launched from off-network, so the network access component should be read as adjacent/radio-adjacent.
RemediationAI
No exact fix version is identifiable from the available data; the authoritative remediation reference is Qualcomm's May 2026 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html), so patching follows the usual Qualcomm model where the chipset vendor fixes the WLAN firmware and OEMs (handset, PC, router, automotive, and IoT vendors) must integrate and ship it in a device firmware/OS update - patch availability for any specific SKU above should be confirmed against that bulletin and the OEM's own advisory rather than assumed. Until updated firmware is deployed, the single most effective compensating control is to disable 802.11r Fast BSS Transition (FT) roaming on the affected network infrastructure or in the affected client's roaming profile, which removes the vulnerable frame class entirely; the trade-off is slower, less seamless hand-offs, which can degrade VoIP and real-time roaming and may be unacceptable in enterprise voice or large-venue deployments, and some clients will silently fall back to standard 802.11 association. Reinforcing the frame-authentication surface helps because the attack requires an attacker to be within radio range and generally to impersonate or operate an AP: enforce WPA3/SAE and 802.11w Protected Management Frames where the client and AP support it (PMF will not stop this specific unauthenticated FT response parsing flaw, but it materially raises the cost of rogue/evil-twin AP operation), and deploy WIDS/WIPS or AP inventory monitoring to detect spoofed BSSIDs and unexpected FT management frames near affected devices. Physical/radio containment - reducing attacker radio access to sensitive sites or using directional/site-survey-driven AP placement - lowers exposure, but at meaningful operational cost and with no guarantee of exclusion. Given the transient, self-recovering nature of the impact, the negligible EPSS score, and no evidence of public exploit code or KEV listing, remediation can be scheduled with normal firmware-maintenance cadence rather than treated as an emergency, prioritizing devices whose networks actually enable 802.11r roaming.
More in Snapdragon
View allRemote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authoriza
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack
Buffer overflow in Qualcomm Snapdragon firmware enables authentication bypass on adjacent networks, allowing remote unau
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a t
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries a
Local privilege escalation and memory corruption in Qualcomm Snapdragon WLAN firmware occurs when the driver parses malf
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overf
Memory corruption in Qualcomm Snapdragon Strongbox component allows local low-privileged attackers to trigger a buffer o
Local privilege escalation in Qualcomm Snapdragon chipsets stems from an out-of-bounds memory access in the Strongbox tr
Memory corruption in Qualcomm Snapdragon chipsets allows adjacent network attackers to achieve arbitrary code execution
Bootloader integrity bypass in Qualcomm Snapdragon platforms allows a high-privileged local attacker to write to a speci
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw duri
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today