Qualcomm — CraftedSignal Threat Feed

Qualcomm PLC FW Buffer Overflow via Incorrect Authorization (CVE-2026-25293)

hello@craftedsignal.io — Mon, 04 May 2026 17:16:22 +0000

CVE-2026-25293 describes a buffer overflow vulnerability affecting Qualcomm’s Programmable Logic Controller Firmware (PLC FW). The root cause is an incorrect authorization mechanism within the firmware. This flaw could allow an attacker to potentially overwrite memory buffers, leading to arbitrary code execution or denial of service. The vulnerability was disclosed in Qualcomm’s May 2026 security bulletin. Successful exploitation of this vulnerability could allow unauthorized modification of PLC configurations, potentially impacting industrial control systems and automation processes. The affected PLC FW is used in a range of industrial applications, increasing the scope and severity of this vulnerability.

Attack Chain

Attacker identifies a vulnerable PLC FW device on the network.
The attacker leverages CVE-2026-25293 to bypass authorization checks.
A crafted network packet is sent to the PLC FW, exploiting the buffer overflow.
The overflowed buffer overwrites critical memory regions.
Attacker gains control of PLC FW execution flow.
Malicious code is injected into the PLC memory space.
The injected code executes, potentially modifying PLC logic or disrupting operations.
The attacker achieves unauthorized control over the PLC, leading to disruption, data manipulation, or system compromise.

Impact

Successful exploitation of CVE-2026-25293 could allow attackers to gain complete control over Programmable Logic Controllers (PLCs). This could lead to significant disruptions in industrial control systems, manufacturing processes, and other automated systems. The vulnerability affects Qualcomm PLC FW, potentially impacting a large number of devices across various sectors. The high CVSS score of 9.6 reflects the critical impact of this vulnerability, including the potential for complete system compromise and denial of service.

Recommendation

Apply the security patches provided by Qualcomm as detailed in their May 2026 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html) to remediate CVE-2026-25293.
Deploy the Sigma rule “Detect Suspicious Network Traffic to PLC Devices” to identify potential exploitation attempts.
Implement strict network segmentation to limit the attack surface and prevent lateral movement to PLC devices.
Monitor network traffic for unexpected patterns or unauthorized access attempts to PLC devices.

Qualcomm Driver IOCTL Memory Corruption Vulnerability

hello@craftedsignal.io — Mon, 04 May 2026 17:16:21 +0000

A memory corruption vulnerability has been identified in Qualcomm drivers, tracked as CVE-2025-47408. This vulnerability occurs when one driver makes an Input/Output Control (IOCTL) call to another driver using a malformed or invalid input/output buffer. The flaw stems from improper validation or handling of the provided buffer, leading to a memory corruption condition. Successful exploitation of this vulnerability could lead to arbitrary code execution, privilege escalation, or a denial-of-service condition. This vulnerability was disclosed in the May 2026 Qualcomm Security Bulletin. The potential impact necessitates that detection engineering teams prioritize identifying and mitigating this threat across systems utilizing affected Qualcomm components.

Attack Chain

An attacker gains initial access to the system, potentially through social engineering or exploiting another vulnerability.
The attacker identifies a vulnerable Qualcomm driver that is susceptible to IOCTL calls with invalid buffers.
The attacker develops a malicious driver or application capable of making IOCTL calls.
The malicious driver crafts a specific IOCTL request with a purposefully malformed input/output buffer.
The malicious driver sends the crafted IOCTL request to the targeted Qualcomm driver.
The targeted Qualcomm driver receives the IOCTL request and attempts to process the invalid buffer.
Due to the malformed buffer, the driver’s memory management routines are corrupted, leading to a write to an arbitrary memory location.
The attacker leverages the memory corruption to execute arbitrary code, escalate privileges, or cause a denial-of-service condition.

Impact

Successful exploitation of CVE-2025-47408 can have severe consequences. An attacker can gain complete control over the affected system, potentially leading to data theft, system compromise, or disruption of services. While the specific number of affected devices or sectors is not explicitly stated, the widespread use of Qualcomm components in various devices suggests a broad potential impact. If successful, this exploit could allow attackers to install persistent backdoors, steal sensitive information, or use the compromised device as a launching point for further attacks within the network.

Recommendation

Monitor process creations for unsigned or untrusted drivers being loaded, and deploy the first Sigma rule provided below, to identify potential malicious driver activity.
Enable driver verifier on test systems using Qualcomm drivers to trigger memory corruption issues and aid in reverse engineering the vulnerability.
Review Qualcomm’s May 2026 Security Bulletin for specific device models and affected driver versions to prioritize patching efforts.
Implement the second Sigma rule to detect suspicious IOCTL calls originating from unusual processes or locations, focusing on potential exploitation attempts of CVE-2025-47408.

Memory Corruption Vulnerability in Digital Signal Processor (CVE-2025-47407)

hello@craftedsignal.io — Mon, 04 May 2026 17:16:21 +0000

CVE-2025-47407 is a memory corruption vulnerability reported by Qualcomm, Inc., affecting digital signal processors (DSPs). The vulnerability stems from an allocation failure at the kernel level during process creation on the DSP. This can lead to memory corruption, potentially allowing an attacker to execute arbitrary code with elevated privileges. While the exact products affected are not specified, the issue resides within Qualcomm DSPs and could impact various devices utilizing these processors. This vulnerability was published on May 4, 2026, and requires patching of the affected DSP firmware to mitigate the risk.

Attack Chain

An attacker gains initial access to a device containing a vulnerable Qualcomm DSP.
The attacker triggers a process creation event on the DSP. This could involve sending a specifically crafted request to the DSP or exploiting another vulnerability to initiate the process creation.
During the process creation, a memory allocation failure occurs within the DSP kernel.
This allocation failure leads to memory corruption, where data is written to an incorrect memory location.
The attacker leverages the memory corruption to overwrite critical kernel data structures or code.
The attacker injects malicious code into the corrupted memory region.
The DSP executes the injected malicious code, granting the attacker control over the DSP.
The attacker can then use the compromised DSP to further compromise the device or network it is connected to.

Impact

Successful exploitation of CVE-2025-47407 allows an attacker to execute arbitrary code on the DSP with elevated privileges. This can lead to a complete compromise of the affected device, allowing the attacker to steal sensitive data, install malware, or use the device as a launchpad for further attacks. The vulnerability can potentially impact a wide range of devices that utilize Qualcomm DSPs.

Recommendation

Monitor process creation events for anomalies that may indicate a memory allocation failure, using the process_creation log category and filtering for processes related to the digital signal processor.
Apply the security patch released by Qualcomm, as referenced in the advisory URL (https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html), to address the memory corruption vulnerability.
Deploy the Sigma rule provided below to detect potential exploitation attempts by monitoring for specific events related to process creation and memory allocation.

Qualcomm Camera Sensor Memory Corruption Vulnerability

hello@craftedsignal.io — Tue, 23 Jan 2024 10:00:00 +0000

CVE-2025-47405 is a high-severity vulnerability affecting Qualcomm products. It stems from a memory corruption issue that occurs when processing camera sensor input/output control codes with invalid output buffers. This vulnerability could be exploited by a local attacker with low privileges, potentially leading to memory corruption, denial of service, or arbitrary code execution. The vulnerability was reported to NIST on May 4, 2026. The specific Qualcomm products affected are not explicitly mentioned, but the issue lies within the camera sensor processing component. This vulnerability is concerning because successful exploitation could compromise the device’s integrity and availability.

Attack Chain

A malicious application is installed on the target device, leveraging existing permissions or exploiting other vulnerabilities for installation.
The malicious application gains low-level privileges, potentially through privilege escalation techniques, if necessary.
The application interacts with the camera sensor through input/output control codes (IOCTLs).
The application crafts a specific IOCTL request with an invalid output buffer size or memory address.
The camera sensor processing component attempts to write data to the invalid output buffer.
This write operation triggers a memory corruption condition due to the out-of-bounds access.
The memory corruption can lead to a denial of service, causing the device to crash or become unresponsive.
In more severe scenarios, the memory corruption could be leveraged to achieve arbitrary code execution, allowing the attacker to gain full control of the device.

Impact

Successful exploitation of CVE-2025-47405 can lead to a range of negative consequences, from denial of service to arbitrary code execution. If an attacker gains code execution, they could potentially steal sensitive data, install malware, or use the device as part of a botnet. The exact number of affected devices is unknown, but given Qualcomm’s widespread presence in mobile devices and other embedded systems, the potential impact is significant. Sectors affected would primarily be consumer electronics and potentially industrial control systems using affected Qualcomm components.

Recommendation

Monitor for unexpected or malicious applications interacting with camera sensor devices, using process creation logs (logsource: process_creation, product: android).
Implement endpoint detection rules to detect suspicious process memory access patterns potentially related to memory corruption attempts (logsource: process_creation, product: android).
Refer to Qualcomm’s security bulletin for affected devices and patch information (references: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html).