Vulnerabilities ›

CVE-2025-59610

Medium

CWE-367 — Weakness Type

                    Published: Jun 1, 2026                      ·  Modified: Jun 4, 2026                      ·  Source: NVD                

CVSS v3

6.4

🔗 NVD Official

📄 Description (English)

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

🤖 AI Executive Summary

CVE-2025-59610 is a memory corruption vulnerability in IOCTL request processing caused by concurrent modification of user-space buffers when API versions mismatch. This flaw could allow local attackers to cause denial of service or potentially execute arbitrary code with elevated privileges.

📄 Description (Arabic)

تحدث هذه الثغرة عند معالجة طلبات IOCTL حيث يحدث عدم توافق بين إصدارات API مما يؤدي إلى تعديل متزامن على مخازن مؤقتة في مساحة المستخدم. يمكن للمهاجمين المحليين استغلال هذا الضعف لإحداث فساد في الذاكرة وتحقيق رفض الخدمة أو تنفيذ كود ضار.

🤖 ملخص تنفيذي (AI)

هذا الثغرة تتعلق بفساد الذاكرة في معالجة طلبات IOCTL بسبب التعديل المتزامن على مخازن مؤقتة في مساحة المستخدم عند عدم توافق إصدارات API. قد يسمح هذا الخلل للمهاجمين المحليين بإحداث رفض الخدمة أو تنفيذ كود تعسفي بامتيازات مرتفعة.

🤖 AI Intelligence Analysis Analyzed: Jun 2, 2026 03:01

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

government telecom energy banking

🎯 MITRE ATT&CK Techniques

T1548.004 T1068 T1499.004

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Update affected kernel or driver components to patched versions that implement proper synchronization mechanisms and API version validation. Apply input validation checks before processing IOCTL requests and use appropriate locking mechanisms to prevent concurrent buffer modifications.

🔧 خطوات المعالجة (العربية)

قم بتحديث مكونات النواة أو برامج التشغيل المتأثرة إلى الإصدارات المصححة التي تطبق آليات المزامنة الصحيحة والتحقق من إصدار API. طبق فحوصات التحقق من صحة الإدخال قبل معالجة طلبات IOCTL واستخدم آليات القفل المناسبة لمنع التعديلات المتزامنة على المخازن المؤقتة.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1 5.2 5.3

🔵 SAMA CSF

CC6.1 CC6.2 CC7.2

🟡 ISO 27001:2022

A.12.2.1 A.12.6.1 A.14.2.1

🔗 References & Sources 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html

product-security@qualcomm.com

Patch Vendor Advisory

📦 Affected Products / CPE 50 entries

qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-

qualcomm:5g_fixed_wireless_access_platform_firmware:-

qualcomm:c-v2x_9150_firmware:-

qualcomm:cq7790_firmware:-

qualcomm:cq8725s_firmware:-

qualcomm:sm7435p_firmware:-

qualcomm:sm7525_firmware:-

qualcomm:sm7550_firmware:-

qualcomm:sm7550p_firmware:-

qualcomm:sm7635p_firmware:-

qualcomm:sm7675_firmware:-

qualcomm:sm7675p_firmware:-

qualcomm:sm8475p_firmware:-

qualcomm:sm8550p_firmware:-

qualcomm:sm8635_firmware:-

qualcomm:sm8635p_firmware:-

qualcomm:sm8650q_firmware:-

qualcomm:sm8735p_firmware:-

qualcomm:sm8750p_firmware:-

qualcomm:sm8845p_firmware:-

qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-

qualcomm:snapdragon_429_mobile_platform_firmware:-

qualcomm:snapdragon_460_mobile_platform_firmware:-

qualcomm:snapdragon_480_5g_mobile_platform_firmware:-

qualcomm:snapdragon_480\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-

qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-

qualcomm:snapdragon_660_mobile_platform_firmware:-

qualcomm:snapdragon_662_mobile_platform_firmware:-

qualcomm:snapdragon_680_4g_mobile_platform_firmware:-

qualcomm:snapdragon_685_4g_mobile_platform_firmware:-

qualcomm:snapdragon_690_5g_mobile_platform_firmware:-

qualcomm:snapdragon_695_5g_mobile_platform_firmware:-

qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-

qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-

qualcomm:snapdragon_7\+_gen_2_mobile_platform_firmware:-

qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-

qualcomm:snapdragon_778g\+_5g_mobile_platform_firmware:-

qualcomm:snapdragon_782g_mobile_platform_firmware:-

qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-

qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-

qualcomm:snapdragon_8_elite_firmware:-

qualcomm:snapdragon_8_elite_gen_5_firmware:-

qualcomm:csra6620_firmware:-

qualcomm:csra6640_firmware:-

qualcomm:csrb31024_firmware:-

qualcomm:fastconnect_6200_firmware:-

qualcomm:fastconnect_6700_firmware:-

📊 CVSS Score

6.4

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityH — High

Privileges RequiredH — High

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity Medium

CVSS Score6.4

CWECWE-367

EPSS0.01%

Exploit No

Patch ✗ No

Published 2026-06-01

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-367

🏢 Vendor Advisories

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-59610

Introduce Yourself

Sign In Required