Unrated

Qualcomm Primary Bootloader Sahara EDL Write-What-Where Memory Corruption

IdentifiersCVE-2026-25262CWE-123

CVE-2026-25262 is a Qualcomm boot-chain vulnerability in the Primary Bootloader/BootROM environment, specifically in the Sahara protocol used by Emergency Download Mode (EDL). The flaw is a write-what-where condition that can trigger memory corruption while the bootloader processes crafted ELF content delivered during the EDL workflow. The vulnerable logic is associated with validation of chunks from a service program loaded over USB before the operating system starts and before normal user access controls are enforced. Because the issue resides in immutable BootROM code on affected chip families, exploitation occurs at a very early stage of device initialization and can permit arbitrary memory writes in the pre-OS boot context.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow arbitrary modification of memory in the boot context before the operating system loads, undermining the integrity of the device boot chain. This can enable implantation of malicious code or a backdoor at a low level, exposure of sensitive user and device data, access to peripherals and sensors, and in some scenarios full compromise of the device. Because exploitation occurs prior to normal platform security enforcement, the resulting compromise may be difficult to detect and can have persistent security consequences.

Mitigation

If you can’t patch tonight, do this now.

Risk reduction depends primarily on controlling physical access to affected devices and restricting opportunities to place them into the Qualcomm emergency download workflow over USB. Devices should be serviced only through trusted and authorized channels, and exposure during repair, inspection, transport, or temporary custody should be minimized. If compromise is suspected, powering the device fully off can reduce immediate exposure until forensic handling or replacement is possible. Operational controls around chain of custody are especially important for high-risk environments using affected Qualcomm-based smartphones, IoT, industrial, healthcare, logistics, banking, or automotive systems.

Remediation

Patch, then assume compromise.

Qualcomm referenced CVE-2026-25262 in its May 2026 security bulletin and indicated that future chips are expected to ship without the flaw. For already released devices built on affected chip families, a complete fix is generally not possible because the vulnerable code is located in immutable BootROM. Where available, organizations and device vendors should apply all Qualcomm- and OEM-provided firmware and security updates for related higher-layer components and boot-chain protections, but such updates do not fully remove the underlying BootROM weakness on shipped hardware.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

zeropath blogNews

Jun 1, 2026

Quick Look: CVE-2026-24088 - Qualcomm Boot Partition Cryptographic Bypass Enables Unauthorized Bootloader Loading - ZeroPath Blog | ZeroPath

A related Qualcomm Primary Bootloader memory corruption vulnerability classified as a write-what-where condition.

kaspersky ruNews

May 22, 2026

Разбираем новую уязвимость чипов Qualcomm | Блог Касперского

Уязвимость в BootROM/Primary Boot Loader чипов Qualcomm, связанная с протоколом Sahara в Emergency Download Mode (EDL), позволяющая произвольную запись в память (write-what-where) и потенциально полный контроль над устройством при наличии физического доступа по USB.

cyber security newsNews

May 5, 2026

Critical Qualcomm Chipset Vulnerabilities Enables Remote Code Execution

A write-what-where vulnerability in the Qualcomm Primary Bootloader that can cause memory corruption when processing crafted ELF files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8