---
id: CVE-2026-25275
title: >-
  Transient DOS when processing authentication frames with invalid FILS
  information element header lengths.
summary: >-
  Transient DOS when processing authentication frames with invalid FILS
  information element header lengths.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-126
vendor: qualcomm
product: q-7790_firmware
affected:
  - q-7790_firmware
  - qam8255p_firmware
  - qam8295p_firmware
  - qamsrv1h_firmware
  - qamsrv1m_firmware
  - qca0000_firmware
  - qca2062_firmware
  - qca2064_firmware
  - qca2065_firmware
  - qca2066_firmware
  - qca4024_firmware
  - qca6391_firmware
  - qca6420_firmware
  - qca6428_firmware
  - qca6430_firmware
  - qca6438_firmware
  - qca6554a_firmware
  - qca6564au_firmware
  - qca6574_firmware
  - qca6574a_firmware
  - qca6574au_firmware
  - qca6584au_firmware
  - qca6595_firmware
  - qca6595au_firmware
  - qca6678aq_firmware
  - qca6688aq_firmware
  - qca6696_firmware
  - qca6698aq_firmware
  - qca6698au_firmware
  - qca6777aq_firmware
  - qca6787aq_firmware
  - qca6797aq_firmware
  - qca8072_firmware
  - qca8075_firmware
  - qca8080_firmware
  - qca8081_firmware
  - qca8082_firmware
  - qca8084_firmware
  - qca8085_firmware
  - qca8337_firmware
  - sm7550_firmware
  - sm7550p_firmware
  - sm7635p_firmware
  - sm7675_firmware
  - sm7675p_firmware
  - sm7750p_firmware
  - sm8475p_firmware
  - sm8550p_firmware
  - sm8635_firmware
  - sm8635p_firmware
  - sm8650q_firmware
  - sm8735p_firmware
  - sm8750p_firmware
  - sm8845p_firmware
  - sm8950_firmware
  - sm8950p_firmware
  - sm8975_firmware
  - sm8975p_firmware
  - smart_audio_400_platform_firmware
  - snapdragon_4_gen_1_mobile_platform_firmware
  - snapdragon_4_gen_2_mobile_platform_firmware
  - snapdragon_460_mobile_platform_firmware
  - snapdragon_480_5g_mobile_platform_firmware
  - snapdragon_480+_5g_mobile_platform_firmware
  - snapdragon_6_gen_1_mobile_platform_firmware
  - snapdragon_6_gen_3_mobile_platform_firmware
  - snapdragon_6_gen_4_mobile_platform_firmware
  - snapdragon_660_mobile_platform_firmware
  - snapdragon_662_mobile_platform_firmware
  - snapdragon_680_4g_mobile_platform_firmware
  - snapdragon_685_4g_mobile_platform_firmware
  - snapdragon_690_5g_mobile_platform_firmware
  - snapdragon_695_5g_mobile_platform_firmware
  - snapdragon_7_gen_1_mobile_platform_firmware
  - snapdragon_7_gen_4_mobile_platform_firmware
  - snapdragon_7+_gen_2_mobile_platform_firmware
  - snapdragon_778g_5g_mobile_platform_firmware
  - snapdragon_778g+_5g_mobile_platform_firmware
  - snapdragon_782g_mobile_platform_firmware
  - snapdragon_7c_compute_platform_firmware
  - snapdragon_g1_gen_2_gaming_platform_firmware
  - 5g_fixed_wireless_access_platform_firmware
  - aqt1000_firmware
  - ar8031_firmware
  - ar8035_firmware
  - c110100_firmware
  - cologne_firmware
  - congo_firmware
  - cq2390m_firmware
  - cq2390s_firmware
  - cq7790_firmware
  - cq7790m_firmware
  - cq8725s_firmware
  - cq8750m_firmware
  - cq8845s_firmware
  - csr8811_firmware
  - csra6620_firmware
  - csra6640_firmware
  - csrb31024_firmware
  - fastconnect_6200_firmware
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:35:49.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25275'
references:
  - url: >-
      https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html
    label: product-security@qualcomm.com
tags:
  - nvd
  - cve.org
epss: 0.00191
epssPercentile: 0.07747
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T14:35:40.315716Z'
ingestedAt: '2026-09-17T05:11:38.055Z'
---

## Overview

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

## Affected

- `q-7790_firmware`
- `qam8255p_firmware`
- `qam8295p_firmware`
- `qamsrv1h_firmware`
- `qamsrv1m_firmware`
- `qca0000_firmware`
- `qca2062_firmware`
- `qca2064_firmware`
- `qca2065_firmware`
- `qca2066_firmware`
- `qca4024_firmware`
- `qca6391_firmware`
- `qca6420_firmware`
- `qca6428_firmware`
- `qca6430_firmware`
- `qca6438_firmware`
- `qca6554a_firmware`
- `qca6564au_firmware`
- `qca6574_firmware`
- `qca6574a_firmware`
- `qca6574au_firmware`
- `qca6584au_firmware`
- `qca6595_firmware`
- `qca6595au_firmware`
- `qca6678aq_firmware`
- `qca6688aq_firmware`
- `qca6696_firmware`
- `qca6698aq_firmware`
- `qca6698au_firmware`
- `qca6777aq_firmware`
- `qca6787aq_firmware`
- `qca6797aq_firmware`
- `qca8072_firmware`
- `qca8075_firmware`
- `qca8080_firmware`
- `qca8081_firmware`
- `qca8082_firmware`
- `qca8084_firmware`
- `qca8085_firmware`
- `qca8337_firmware`
- `sm7550_firmware`
- `sm7550p_firmware`
- `sm7635p_firmware`
- `sm7675_firmware`
- `sm7675p_firmware`
- `sm7750p_firmware`
- `sm8475p_firmware`
- `sm8550p_firmware`
- `sm8635_firmware`
- `sm8635p_firmware`
- `sm8650q_firmware`
- `sm8735p_firmware`
- `sm8750p_firmware`
- `sm8845p_firmware`
- `sm8950_firmware`
- `sm8950p_firmware`
- `sm8975_firmware`
- `sm8975p_firmware`
- `smart_audio_400_platform_firmware`
- `snapdragon_4_gen_1_mobile_platform_firmware`
- `snapdragon_4_gen_2_mobile_platform_firmware`
- `snapdragon_460_mobile_platform_firmware`
- `snapdragon_480_5g_mobile_platform_firmware`
- `snapdragon_480+_5g_mobile_platform_firmware`
- `snapdragon_6_gen_1_mobile_platform_firmware`
- `snapdragon_6_gen_3_mobile_platform_firmware`
- `snapdragon_6_gen_4_mobile_platform_firmware`
- `snapdragon_660_mobile_platform_firmware`
- `snapdragon_662_mobile_platform_firmware`
- `snapdragon_680_4g_mobile_platform_firmware`
- `snapdragon_685_4g_mobile_platform_firmware`
- `snapdragon_690_5g_mobile_platform_firmware`
- `snapdragon_695_5g_mobile_platform_firmware`
- `snapdragon_7_gen_1_mobile_platform_firmware`
- `snapdragon_7_gen_4_mobile_platform_firmware`
- `snapdragon_7+_gen_2_mobile_platform_firmware`
- `snapdragon_778g_5g_mobile_platform_firmware`
- `snapdragon_778g+_5g_mobile_platform_firmware`
- `snapdragon_782g_mobile_platform_firmware`
- `snapdragon_7c_compute_platform_firmware`
- `snapdragon_g1_gen_2_gaming_platform_firmware`
- `5g_fixed_wireless_access_platform_firmware`
- `aqt1000_firmware`
- `ar8031_firmware`
- `ar8035_firmware`
- `c110100_firmware`
- `cologne_firmware`
- `congo_firmware`
- `cq2390m_firmware`
- `cq2390s_firmware`
- `cq7790_firmware`
- `cq7790m_firmware`
- `cq8725s_firmware`
- `cq8750m_firmware`
- `cq8845s_firmware`
- `csr8811_firmware`
- `csra6620_firmware`
- `csra6640_firmware`
- `csrb31024_firmware`
- `fastconnect_6200_firmware`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.