Unrated

Write-what-where in Qualcomm Primary Bootloader Sahara/EDL handling

IdentifiersCVE-2026-25262CWE-123

CVE-2026-25262 is a Qualcomm BootROM/Primary Bootloader vulnerability in the Sahara protocol used by Emergency Download Mode (EDL). The flaw is described as a write-what-where condition that leads to memory corruption when the bootloader processes crafted ELF files or validated chunks of a service program delivered over USB during the EDL workflow. Because this code executes in immutable BootROM before the operating system loads and before normal user access controls are enforced, a successful attacker can perform arbitrary memory writes at a very early boot stage on affected Qualcomm chip families including MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow pre-OS compromise of the device, including arbitrary modification of memory during boot. Reported consequences include implantation of malicious code or a backdoor before the main OS starts, theft of sensitive data such as passwords, files, contacts, and geolocation data, access to sensors including camera and microphone, and in some scenarios full device compromise. Because compromise occurs at the BootROM/bootloader stage, malicious persistence and forensic detection may be difficult.

Mitigation

If you can’t patch tonight, do this now.

Mitigation is primarily operational rather than corrective for already deployed affected hardware. Maintain strict physical control of devices, avoid unauthorized repair or servicing channels, and restrict access during logistics, customs inspection, maintenance, and other scenarios where brief USB access is possible. If compromise is suspected, fully power off the device and subject it to trusted forensic or replacement procedures. Where applicable, use only authorized service centers and keep vendor firmware current to reduce exposure to related attack paths.

Remediation

Patch, then assume compromise.

Qualcomm referenced CVE-2026-25262 in its May 2026 security bulletin and provided security updates to OEMs. However, the vulnerable logic resides in immutable BootROM/Primary Bootloader code, and the available reporting states that already shipped devices cannot be fully fixed in principle. Organizations and users should still apply all firmware and security updates from device manufacturers, as vendors may ship compensating fixes or related hardening in higher layers. Future Qualcomm chips are expected to ship without this flaw.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

kaspersky ruNews

May 22, 2026

Разбираем новую уязвимость чипов Qualcomm | Блог Касперского

Уязвимость в BootROM/Primary Boot Loader чипов Qualcomm, связанная с протоколом Sahara в Emergency Download Mode (EDL), позволяющая произвольную запись в память (write-what-where) и потенциально полный контроль над устройством при наличии физического доступа по USB.

cyber security newsNews

May 5, 2026

Critical Qualcomm Chipset Vulnerabilities Enables Remote Code Execution

A write-what-where vulnerability in the Qualcomm Primary Bootloader that can cause memory corruption when processing crafted ELF files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-25262

NVD

nvd.nist.gov/vuln/detail/CVE-2026-25262

MITRE CWE · CWE-123

cwe.mitre.org