CVE-2026-25302: Improper Verification of Cryptographic Signature in Boot

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-09
Weakness: CWE-347

Description

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Affected products

Qualcomm Ar8035 Firmware: all versions
Qualcomm Cologne Firmware: all versions
Qualcomm Cq2390M Firmware: all versions
Qualcomm Cq2390S Firmware: all versions
Qualcomm Cq7790 Firmware: all versions
Qualcomm Cq7790M Firmware: all versions
Qualcomm Cq8725S Firmware: all versions
Qualcomm Cq8750M Firmware: all versions
Qualcomm Cq8845S Firmware: all versions
Qualcomm Cq8850Ns Firmware: all versions
Qualcomm Csra6620 Firmware: all versions
Qualcomm Csra6640 Firmware: all versions
Qualcomm Fastconnect 6200 Firmware: all versions
Qualcomm Fastconnect 6700 Firmware: all versions
Qualcomm Fastconnect 6800 Firmware: all versions
Qualcomm Fastconnect 6900 Firmware: all versions
Qualcomm Fastconnect 7800 Firmware: all versions
Qualcomm Flight Rb5 5G Platform Firmware: all versions
Qualcomm Fsm20055 Firmware: all versions
Qualcomm Fsm200 Platform Firmware: all versions
Qualcomm Fwa Gen 3 Ultra Firmware: all versions
Qualcomm Fwa Gen 5 Elite Firmware: all versions
Qualcomm G1 Gen 1 Firmware: all versions
Qualcomm G2 Gen 1 Firmware: all versions
Qualcomm G3X Gen 2 Firmware: all versions
Qualcomm Ipq9048 Firmware: all versions
Qualcomm Ipq9570 Firmware: all versions
Qualcomm Ipq9574 Firmware: all versions
Qualcomm Iq-615 Firmware: all versions
Qualcomm Iq-8275 Firmware: all versions

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html

Get alerted when CVE-2026-25302 or the next vulnerability affects your stack