---
id: CVE-2026-25267
title: >-
  Memory corruption when non-secure loader rewrites page tables before secure
  memory initialization.
summary: >-
  Memory corruption when non-secure loader rewrites page tables before secure
  memory initialization.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: 'Qualcomm, Inc.'
product: Snapdragon
affected:
  - Snapdragon 315 5G IoT Modem
  - Snapdragon 5G Fixed Wireless Access Platform
  - Snapdragon 9205 LTE Modem
  - Snapdragon 9205S Modem
  - Snapdragon AQT1000
  - Snapdragon AR8031
  - Snapdragon AR8035
  - Snapdragon Cologne
  - Snapdragon CSRA6620
  - Snapdragon CSRA6640
  - Snapdragon CSRB31024
  - Snapdragon C-V2X 9150
  - Snapdragon FastConnect 6200
  - Snapdragon FastConnect 6700
  - Snapdragon FastConnect 6800
  - Snapdragon FastConnect 6900
  - Snapdragon FastConnect 7800
  - Snapdragon FSM100 Platform
  - Snapdragon G1 Gen 1
  - Snapdragon G3x Gen 2
  - Snapdragon IQ6 Series Platform
  - Snapdragon IQ8 Series Platform
  - Snapdragon IQ9 Series Platform
  - Snapdragon IQX5121
  - Snapdragon MBM415
  - Snapdragon Monaco_IOT
  - Snapdragon Networking Pro 1210 Platform
  - Snapdragon Networking Pro 1610 Platform
  - Snapdragon Networking Pro 610 Platform
  - Snapdragon Networking Pro 810 Platform
  - Snapdragon Q-4390
  - Snapdragon QCA0000
  - Snapdragon QCA4004
  - Snapdragon QCA6174A
  - Snapdragon QCA6391
  - Snapdragon QCA6420
  - Snapdragon QCA6421
  - Snapdragon QCA6426
  - Snapdragon QCA6430
  - Snapdragon QCA6431
  - Snapdragon QCA6436
  - Snapdragon QCA6564
  - Snapdragon QCA6564A
  - Snapdragon QCA6564AU
  - Snapdragon QCA6574
  - Snapdragon QCA6574A
  - Snapdragon QCA6574AU
  - Snapdragon QCA6595
  - Snapdragon QCA6595AU
  - Snapdragon QCA6688AQ
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T07:16:56.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25267'
references:
  - url: >-
      https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html
    label: product-security@qualcomm.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T07:49:23.038Z'
---

## Overview

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.