Vulnerabilities ›

CVE-2025-59604

High

CWE-476 — Weakness Type

                    Published: Jun 1, 2026                      ·  Modified: Jun 8, 2026                      ·  Source: NVD                

CVSS v3

7.8

🔗 NVD Official

📄 Description (English)

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

🤖 AI Executive Summary

CVE-2025-59604 is a high-severity memory corruption vulnerability affecting multiple Qualcomm Snapdragon mobile platforms due to null pointer dereference during memory copy operations. The vulnerability could allow local attackers to cause denial of service or potentially execute arbitrary code with elevated privileges. With no patch currently available, this poses an immediate risk to millions of mobile devices in Saudi Arabia, particularly those used in critical sectors.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Jun 6, 2026 12:32

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability directly impacts Saudi Arabia's mobile ecosystem, affecting government employees, banking sector users (SAMA-regulated institutions), healthcare professionals, and telecommunications customers (STC, Mobily, Zain). High-risk sectors include: (1) Banking & Financial Services - mobile banking apps and payment systems; (2) Government & NCA - official mobile applications and secure communications; (3) Healthcare - medical devices and hospital staff communications; (4) Energy Sector - ARAMCO and related infrastructure personnel; (5) Telecommunications - network operators and enterprise customers. The vulnerability enables local privilege escalation, threatening sensitive data access and system integrity across these sectors.

🏢 Affected Saudi Sectors

Banking & Financial Services Government & Public Administration Healthcare & Medical Services Energy & Utilities Telecommunications Defense & Security Education Retail & E-commerce

🎯 MITRE ATT&CK Techniques

T1548 - Abuse Elevation Control Mechanism T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt T1055 - Process Injection T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1499 - Endpoint Denial of Service

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Inventory all Snapdragon 480/480+, 6 Gen 1/3/4, 662, 680, 685, 690, and 695 devices in your organization

2. Restrict physical access to affected devices and implement device management controls

3. Disable unnecessary local services and applications that could trigger the vulnerability

4. Enable SELinux/MAC enforcement to maximum levels to contain potential privilege escalation



Compensating Controls (until patch available):

5. Deploy Mobile Device Management (MDM) solutions with application whitelisting

6. Implement strict application permission policies - deny unnecessary local access permissions

7. Monitor system logs for memory corruption indicators and privilege escalation attempts

8. Disable USB debugging and restrict ADB access

9. Enforce strong device encryption and secure boot verification



Detection Rules:

10. Monitor kernel logs for null pointer dereference errors and memory faults

11. Alert on unexpected process privilege escalation from unprivileged contexts

12. Track memory access violations and segmentation faults in system logs

13. Monitor for unusual memory copy operations or buffer operations



Patching Strategy:

14. Subscribe to Qualcomm security bulletins for patch availability

15. Prepare staged deployment plan for firmware updates once available

16. Test patches in isolated environment before enterprise deployment

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. قم بحصر جميع أجهزة Snapdragon 480/480+ و6 Gen 1/3/4 و662 و680 و685 و690 و695 في مؤسستك

2. قيد الوصول المادي للأجهزة المتأثرة وطبق ضوابط إدارة الأجهزة

3. عطل الخدمات والتطبيقات المحلية غير الضرورية التي قد تؤدي لتفعيل الثغرة

4. فعّل SELinux/MAC بمستويات قصوى لاحتواء محاولات تصعيد الامتيازات

الضوابط البديلة (حتى توفر التصحيح):

5. نشر حلول إدارة الأجهزة المحمولة (MDM) مع قائمة بيضاء للتطبيقات

6. طبق سياسات صارمة لأذونات التطبيقات - رفض الوصول المحلي غير الضروري

7. راقب سجلات النظام لمؤشرات فساد الذاكرة ومحاولات تصعيد الامتيازات

8. عطل تصحيح أخطاء USB والوصول المقيد لـ ADB

9. فرض تشفير الأجهزة القوي والتحقق من التمهيد الآمن

قواعد الكشف:

10. راقب سجلات النواة لأخطاء إلغاء المؤشر الفارغ وأعطال الذاكرة

11. أصدر تنبيهات لتصعيد امتيازات العمليات غير المتوقعة من السياقات غير المميزة

12. تتبع انتهاكات الوصول للذاكرة وأخطاء التجزئة في سجلات النظام

13. راقب عمليات نسخ الذاكرة غير العادية أو عمليات المخزن المؤقت

استراتيجية التصحيح:

14. اشترك في نشرات أمان Qualcomm لتوفر التصحيحات

15. جهز خطة نشر مرحلية لتحديثات البرامج الثابتة عند توفرها

16. اختبر التصحيحات في بيئة معزولة قبل النشر على مستوى المؤسسة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 - 2.1.1 Asset Management and Inventory ECC 2024 - 2.2.1 Vulnerability Management ECC 2024 - 2.3.1 Patch Management ECC 2024 - 3.1.1 Access Control ECC 2024 - 3.2.1 Privilege Management

🔵 SAMA CSF

SAMA CSF - Identify: Asset Management SAMA CSF - Protect: Access Control SAMA CSF - Detect: Anomaly Detection SAMA CSF - Respond: Incident Response

🟡 ISO 27001:2022

ISO 27001:2022 - A.5.9 Access Control ISO 27001:2022 - A.8.1 User Endpoint Devices ISO 27001:2022 - A.8.2 Privileged Access Rights ISO 27001:2022 - A.12.6.1 Management of Technical Vulnerabilities

🟣 PCI DSS v4.0.1

PCI DSS 4.0 - Requirement 2: Apply Secure Configurations PCI DSS 4.0 - Requirement 6: Develop and Maintain Secure Systems PCI DSS 4.0 - Requirement 11: Test Security Systems

🔗 References & Sources 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html

product-security@qualcomm.com

Vendor Advisory

📦 Affected Products / CPE 50 entries

qualcomm:snapdragon_480_5g_mobile_platform_firmware:-

qualcomm:snapdragon_480\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-

qualcomm:snapdragon_662_mobile_platform_firmware:-

qualcomm:snapdragon_680_4g_mobile_platform_firmware:-

qualcomm:snapdragon_685_4g_mobile_platform_firmware:-

qualcomm:snapdragon_690_5g_mobile_platform_firmware:-

qualcomm:snapdragon_695_5g_mobile_platform_firmware:-

qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-

qualcomm:snapdragon_7\+_gen_2_mobile_platform_firmware:-

qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-

qualcomm:snapdragon_778g\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_782g_mobile_platform_firmware:-

qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-

qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-

qualcomm:snapdragon_8_elite_firmware:-

qualcomm:snapdragon_8_elite_gen_5_firmware:-

qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-

qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-

qualcomm:snapdragon_8\+_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-

qualcomm:snapdragon_865_5g_mobile_platform_firmware:-

qualcomm:snapdragon_865\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_870_5g_mobile_platform_firmware:-

qualcomm:snapdragon_888_5g_mobile_platform_firmware:-

qualcomm:snapdragon_888\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_8cx_gen_3_compute_platform_firmware:-

qualcomm:snapdragon_ar1_gen_1_platform_firmware:-

qualcomm:snapdragon_ar1\+_gen_1_platform_firmware:-

qualcomm:snapdragon_auto_5g_modem-rf_gen_2_firmware:-

qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-

qualcomm:snapdragon_x32_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x35_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x62_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-

qualcomm:ar8035_firmware:-

qualcomm:cologne_firmware:-

qualcomm:cq7790_firmware:-

qualcomm:cq8725s_firmware:-

qualcomm:cq8750m_firmware:-

qualcomm:csra6620_firmware:-

qualcomm:csra6640_firmware:-

qualcomm:fastconnect_6200_firmware:-

qualcomm:fastconnect_6700_firmware:-

📊 CVSS Score

7.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.8

CWECWE-476

EPSS0.01%

Exploit No

Patch ✗ No

Published 2026-06-01

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

CWE-476

🏢 Vendor Advisories

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-59604

Introduce Yourself

Sign In Required