CVE-2026-25278

HIGH

Published Sep 17, 2026 Modified Sep 22, 2026 CWE-367

Description

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

Is your site exposed to CVE-2026-25278?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0005

Probability of exploitation

0.00%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-367 CWE-367

Affected Products

Vendor	Product	Versions
qualcomm	lemans_au_lgit_firmware	All
qualcomm	lemans_au_lgit	All
qualcomm	lemansau_firmware	All
qualcomm	lemansau	All
qualcomm	qam8255p_firmware	All
qualcomm	qam8255p	All
qualcomm	qam8295p_firmware	All
qualcomm	qam8295p	All
qualcomm	qam8620p_firmware	All
qualcomm	qam8620p	All
qualcomm	qamsrv1h_firmware	All
qualcomm	qamsrv1h	All
qualcomm	qamsrv1m_firmware	All
qualcomm	qamsrv1m	All
qualcomm	qca6574au_firmware	All
qualcomm	qca6574au	All
qualcomm	qca6595_firmware	All
qualcomm	qca6595	All
qualcomm	qca6595au_firmware	All
qualcomm	qca6595au	All
qualcomm	qca6688aq_firmware	All
qualcomm	qca6688aq	All
qualcomm	qca6696_firmware	All
qualcomm	qca6696	All
qualcomm	qca6698aq_firmware	All
qualcomm	qca6698aq	All
qualcomm	qca6797aq_firmware	All
qualcomm	qca6797aq	All
qualcomm	qca8695au_firmware	All
qualcomm	qca8695au	All
qualcomm	sa6155p_firmware	All
qualcomm	sa6155p	All
qualcomm	sa7255p_firmware	All
qualcomm	sa7255p	All
qualcomm	sa7775p_firmware	All
qualcomm	sa7775p	All
qualcomm	sa8155p_firmware	All
qualcomm	sa8155p	All
qualcomm	sa8195p_firmware	All
qualcomm	sa8195p	All
qualcomm	sa8255p_firmware	All
qualcomm	sa8255p	All
qualcomm	sa8295p_firmware	All
qualcomm	sa8295p	All
qualcomm	sa8540p_firmware	All
qualcomm	sa8540p	All
qualcomm	sa8620p_firmware	All
qualcomm	sa8620p	All
qualcomm	sa8770p_firmware	All
qualcomm	sa8770p	All
qualcomm	sa9000p_firmware	All
qualcomm	sa9000p	All
qualcomm	srv1h_firmware	All
qualcomm	srv1h	All
qualcomm	srv1l_firmware	All
qualcomm	srv1l	All
qualcomm	srv1m_firmware	All
qualcomm	srv1m	All

References

Advisories & Patches

https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html

Frequently Asked Questions

What is CVE-2026-25278? +

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-25278? +

CVE-2026-25278 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0005, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-25278? +

CVE-2026-25278 affects products from qualcomm, specifically: lemans_au_lgit, lemans_au_lgit_firmware, lemansau, lemansau_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8620p, qam8620p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6574au, qca6574au_firmware, qca6595, qca6595_firmware, qca6595au, qca6595au_firmware, qca6688aq, qca6688aq_firmware, qca6696, qca6696_firmware, qca6698aq, qca6698aq_firmware, qca6797aq, qca6797aq_firmware, qca8695au, qca8695au_firmware, sa6155p, sa6155p_firmware, sa7255p, sa7255p_firmware, sa7775p, sa7775p_firmware, sa8155p, sa8155p_firmware, sa8195p, sa8195p_firmware, sa8255p, sa8255p_firmware, sa8295p, sa8295p_firmware, sa8540p, sa8540p_firmware, sa8620p, sa8620p_firmware, sa8770p, sa8770p_firmware, sa9000p, sa9000p_firmware, srv1h, srv1h_firmware, srv1l, srv1l_firmware, srv1m, srv1m_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-25278? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-5958

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations …

CVE-2026-42336

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) …

CVE-2025-26620

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition …

CVE-2024-53694

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could …

CVE-2025-32784

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race …

CVE-2025-34027

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at …