{"id":"CVE-2026-25275","title":"Transient DOS when processing authentication frames with invalid FILS information element header lengths.","summary":"Transient DOS when processing authentication frames with invalid FILS information element header lengths.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-126"],"vendor":"qualcomm","product":"q-7790_firmware","affected":["q-7790_firmware","qam8255p_firmware","qam8295p_firmware","qamsrv1h_firmware","qamsrv1m_firmware","qca0000_firmware","qca2062_firmware","qca2064_firmware","qca2065_firmware","qca2066_firmware","qca4024_firmware","qca6391_firmware","qca6420_firmware","qca6428_firmware","qca6430_firmware","qca6438_firmware","qca6554a_firmware","qca6564au_firmware","qca6574_firmware","qca6574a_firmware","qca6574au_firmware","qca6584au_firmware","qca6595_firmware","qca6595au_firmware","qca6678aq_firmware","qca6688aq_firmware","qca6696_firmware","qca6698aq_firmware","qca6698au_firmware","qca6777aq_firmware","qca6787aq_firmware","qca6797aq_firmware","qca8072_firmware","qca8075_firmware","qca8080_firmware","qca8081_firmware","qca8082_firmware","qca8084_firmware","qca8085_firmware","qca8337_firmware","sm7550_firmware","sm7550p_firmware","sm7635p_firmware","sm7675_firmware","sm7675p_firmware","sm7750p_firmware","sm8475p_firmware","sm8550p_firmware","sm8635_firmware","sm8635p_firmware","sm8650q_firmware","sm8735p_firmware","sm8750p_firmware","sm8845p_firmware","sm8950_firmware","sm8950p_firmware","sm8975_firmware","sm8975p_firmware","smart_audio_400_platform_firmware","snapdragon_4_gen_1_mobile_platform_firmware","snapdragon_4_gen_2_mobile_platform_firmware","snapdragon_460_mobile_platform_firmware","snapdragon_480_5g_mobile_platform_firmware","snapdragon_480+_5g_mobile_platform_firmware","snapdragon_6_gen_1_mobile_platform_firmware","snapdragon_6_gen_3_mobile_platform_firmware","snapdragon_6_gen_4_mobile_platform_firmware","snapdragon_660_mobile_platform_firmware","snapdragon_662_mobile_platform_firmware","snapdragon_680_4g_mobile_platform_firmware","snapdragon_685_4g_mobile_platform_firmware","snapdragon_690_5g_mobile_platform_firmware","snapdragon_695_5g_mobile_platform_firmware","snapdragon_7_gen_1_mobile_platform_firmware","snapdragon_7_gen_4_mobile_platform_firmware","snapdragon_7+_gen_2_mobile_platform_firmware","snapdragon_778g_5g_mobile_platform_firmware","snapdragon_778g+_5g_mobile_platform_firmware","snapdragon_782g_mobile_platform_firmware","snapdragon_7c_compute_platform_firmware","snapdragon_g1_gen_2_gaming_platform_firmware","5g_fixed_wireless_access_platform_firmware","aqt1000_firmware","ar8031_firmware","ar8035_firmware","c110100_firmware","cologne_firmware","congo_firmware","cq2390m_firmware","cq2390s_firmware","cq7790_firmware","cq7790m_firmware","cq8725s_firmware","cq8750m_firmware","cq8845s_firmware","csr8811_firmware","csra6620_firmware","csra6640_firmware","csrb31024_firmware","fastconnect_6200_firmware"],"published":"2026-09-17","updated":"2026-09-22","sourceUpdated":"2026-09-22T19:35:49.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25275","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html","label":"product-security@qualcomm.com"}],"tags":["nvd","cve.org"],"epss":0.00191,"epssPercentile":0.08993,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T14:35:40.315716Z"},"ingestedAt":"2026-09-17T05:11:38.055Z","slug":"CVE-2026-25275","body":"## Overview\n\nTransient DOS when processing authentication frames with invalid FILS information element header lengths.\n\n## Affected\n\n- `q-7790_firmware`\n- `qam8255p_firmware`\n- `qam8295p_firmware`\n- `qamsrv1h_firmware`\n- `qamsrv1m_firmware`\n- `qca0000_firmware`\n- `qca2062_firmware`\n- `qca2064_firmware`\n- `qca2065_firmware`\n- `qca2066_firmware`\n- `qca4024_firmware`\n- `qca6391_firmware`\n- `qca6420_firmware`\n- `qca6428_firmware`\n- `qca6430_firmware`\n- `qca6438_firmware`\n- `qca6554a_firmware`\n- `qca6564au_firmware`\n- `qca6574_firmware`\n- `qca6574a_firmware`\n- `qca6574au_firmware`\n- `qca6584au_firmware`\n- `qca6595_firmware`\n- `qca6595au_firmware`\n- `qca6678aq_firmware`\n- `qca6688aq_firmware`\n- `qca6696_firmware`\n- `qca6698aq_firmware`\n- `qca6698au_firmware`\n- `qca6777aq_firmware`\n- `qca6787aq_firmware`\n- `qca6797aq_firmware`\n- `qca8072_firmware`\n- `qca8075_firmware`\n- `qca8080_firmware`\n- `qca8081_firmware`\n- `qca8082_firmware`\n- `qca8084_firmware`\n- `qca8085_firmware`\n- `qca8337_firmware`\n- `sm7550_firmware`\n- `sm7550p_firmware`\n- `sm7635p_firmware`\n- `sm7675_firmware`\n- `sm7675p_firmware`\n- `sm7750p_firmware`\n- `sm8475p_firmware`\n- `sm8550p_firmware`\n- `sm8635_firmware`\n- `sm8635p_firmware`\n- `sm8650q_firmware`\n- `sm8735p_firmware`\n- `sm8750p_firmware`\n- `sm8845p_firmware`\n- `sm8950_firmware`\n- `sm8950p_firmware`\n- `sm8975_firmware`\n- `sm8975p_firmware`\n- `smart_audio_400_platform_firmware`\n- `snapdragon_4_gen_1_mobile_platform_firmware`\n- `snapdragon_4_gen_2_mobile_platform_firmware`\n- `snapdragon_460_mobile_platform_firmware`\n- `snapdragon_480_5g_mobile_platform_firmware`\n- `snapdragon_480+_5g_mobile_platform_firmware`\n- `snapdragon_6_gen_1_mobile_platform_firmware`\n- `snapdragon_6_gen_3_mobile_platform_firmware`\n- `snapdragon_6_gen_4_mobile_platform_firmware`\n- `snapdragon_660_mobile_platform_firmware`\n- `snapdragon_662_mobile_platform_firmware`\n- `snapdragon_680_4g_mobile_platform_firmware`\n- `snapdragon_685_4g_mobile_platform_firmware`\n- `snapdragon_690_5g_mobile_platform_firmware`\n- `snapdragon_695_5g_mobile_platform_firmware`\n- `snapdragon_7_gen_1_mobile_platform_firmware`\n- `snapdragon_7_gen_4_mobile_platform_firmware`\n- `snapdragon_7+_gen_2_mobile_platform_firmware`\n- `snapdragon_778g_5g_mobile_platform_firmware`\n- `snapdragon_778g+_5g_mobile_platform_firmware`\n- `snapdragon_782g_mobile_platform_firmware`\n- `snapdragon_7c_compute_platform_firmware`\n- `snapdragon_g1_gen_2_gaming_platform_firmware`\n- `5g_fixed_wireless_access_platform_firmware`\n- `aqt1000_firmware`\n- `ar8031_firmware`\n- `ar8035_firmware`\n- `c110100_firmware`\n- `cologne_firmware`\n- `congo_firmware`\n- `cq2390m_firmware`\n- `cq2390s_firmware`\n- `cq7790_firmware`\n- `cq7790m_firmware`\n- `cq8725s_firmware`\n- `cq8750m_firmware`\n- `cq8845s_firmware`\n- `csr8811_firmware`\n- `csra6620_firmware`\n- `csra6640_firmware`\n- `csrb31024_firmware`\n- `fastconnect_6200_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}