CVE-2026-25289: Qualcomm Snapdragon WLAN Firmware NAN Stack Buffer Overflow, CVSS 9.6
Qualcomm August security bulletin discloses WLAN firmware stack buffer overflow CVE-2026-25289, CVSS 9.6, affecting hundreds of Snapdragon devices across phones/auto/IoT/wearables.
Qualcomm disclosed CVE-2026-25289 in its August 2026 security bulletin: a stack buffer overflow in the Qualcomm WLAN firmware NAN (Neighbor Awareness Networking) service-discovery frame parse path. CVSS v3.1 9.6 (Critical). Affects hundreds of Snapdragon-platform devices across mobile, automotive, compute, IoT, wearables, AR/VR, and Wi-Fi connectivity chips. An attacker only needs to send crafted NAN service-discovery frames within radio range of the victim to execute arbitrary code at WLAN firmware privilege. Scope is Changed—firmware compromise may further affect the application processor. NAN is tightly bound to Wi-Fi Aware (Wi-Fi Alliance, 2016 onward) and is the de facto standard for nearby sharing, AirDrop-class apps, indoor positioning, and smart-home discovery; nearly all commercial Wi-Fi endpoints after 2020 enable the NAN subsystem by default.
Incident Overview
Qualcomm notified customers via a security notice on May 4, 2026, and formally published the August 2026 Security Bulletin with fixed firmware packages. Armis, Antihacking Online, and Qualcomm's official bulletin disclosed in parallel; NVD adopted Qualcomm's CVSS 9.6. Affected range spans Snapdragon SD 865/870/8 Gen 1 through 8 Elite Gen 5 mobile platforms, SA7255P/SA8255P/SA8770P/SA9000P automotive platforms, X1E80100/SC8380XP compute platforms, IPQ5300/5312/5332/9554/9570 and other IoT and Networking Pro platforms, plus FastConnect 6200/6700/6800/6900/7800 and WCN6450/6740/6755/7860/7881 Wi-Fi connectivity chips.
Technical Details
- CVSS v3.1: 9.6 / Critical, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; Scope Changed.
- Trigger: Qualcomm WLAN firmware NAN Service Discovery Frame parser.
- Root cause: the parser trusts an attacker-controlled length field when handling the "Device Capability Extended" attribute and copies data into a fixed-size stack buffer—stack buffer overflow (CWE-121).
- Attack vector: Adjacent—attacker only needs to broadcast crafted NAN frames within Wi-Fi range of the victim. No user interaction, no authentication, no association.
- Impact: WLAN firmware-level RCE. After firmware compromise, shared-memory interfaces can be used to cross into the application processor, escalating to higher-layer device takeover.
- Affected chip families: Snapdragon, FastConnect, QCA, QCN, WCN, IPQ, Networking Pro, etc.
Impact Assessment
Among the widest-coverage Qualcomm WLAN bugs of H2 2026:
- Broad device coverage: phones, tablets, laptops, smart home, wearables, AR/VR headsets, vehicles, smart meters, Wi-Fi routers. Flagship SoCs through Snapdragon 8 Elite Gen 5 alone span five product generations.
- Zero-trust exploit conditions: no user action, no auth, no physical contact, no enterprise-network access. Public Wi-Fi, cafes, airports, subways are sufficient.
- Potential privilege expansion: Scope:Changed means firmware RCE can spread to the application processor, then SMS, contacts, crypto wallets, mobile-payment credentials—a typical high-value persistence entry.
- Lagging supply-chain response: firmware fixes must be pushed via each OEM/ODM OTA channel; no unified downloadable patch pack. Enterprises struggle to inventory all affected endpoints.
Remediation
- Upgrade to the August patch promptly: Android devices to security patch level 2026-08-05 or later; IoT/IPQ devices must get updated firmware from the vendor.
- Temporary mitigation: disable Wi-Fi Aware/NAN on endpoints (Android: Settings > Wi-Fi > Advanced > Wi-Fi Aware; Windows Device Manager: disable Wi-Fi Aware).
- Linux firewall policy: `iptables -A INPUT -p UDP --dport 7668 -j DROP` to block NAN traffic (NAN uses UDP port 7668).
- Enterprise Wi-Fi: ACL NAN frames at APs; isolate BYOD first; disable NAN on endpoints that do not need neighbor awareness.
- Detection: SIEM alerts on abnormal WLAN-subsystem crashes, restarts, firmware-upgrade failures; targeted traffic inspection of public hotspots and venue Wi-Fi.
References
- Qualcomm August 2026 Security Bulletin
- NVD: CVE-2026-25289 details
- Armis CVE-2026-25289 vulnerability intelligence
- Antihacking Online: CVE-2026-25289 technical analysis