PT-2026-34740 · Qualcomm · Snapdragon

CVE-2026-25262 · Published 2026-03-14 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon chips (MDM and MSM series)

Description A hardware-level flaw exists in the BootROM of certain legacy and mid-range Snapdragon chipsets. The issue is exposed via the Sahara protocol in Emergency Download Mode (EDL), allowing an attacker with physical access to bypass secure boot, access data, and potentially achieve full device compromise. This represents a supply-chain risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-123

Related Identifiers

BDU:2026-09352

CVE-2026-25262

Affected Products

Snapdragon

References · 11

• https://bdu.fstec.ru/vul/2026-09352 · Security Note
• https://twitter.com/robytenk/status/2047298620349616506 · Twitter Post
• https://docs.qualcomm.com/securitybulletin/may-2026-bulletin.html · Note
• https://securitylab.ru/news/574589.php · Note
• https://ics-cert.kaspersky.com/vulnerabilities/qualcomm-chipsets-series-write-what-where-condition-vulnerability-in-bootrom · Note
• https://reddit.com/r/ExploitDev/comments/1uxaju2/cve202625262_writewhatwhere_in_qualcomm_sahara · Reddit Post
• https://t.me/pentestingnews/74394 · Telegram Post
• https://twitter.com/timexiaomi/status/2047965177178456255 · Twitter Post
• https://reddit.com/r/ExploitDev/comments/1uqqcst/cve202625262_writewhatwhere_in_qualcomm_sahara · Reddit Post
• https://twitter.com/zippgod24/status/2071951269732716833 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1uqsu4v/cve202625262_writewhatwhere_in_qualcomm_sahara · Reddit Post