CVE-2026-25269

MEDIUM6.7

Published 2026-10-06 · Updated 2026-10-09 · Source product-security@qualcomm.com

Description

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-787

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-114192
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
2026-10-24 · score 6.5
CVE-2026-116020
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
2026-10-24 · score 5.4
CVE-2026-116018
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
2026-10-24 · score 4.3
CVE-2026-116017
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
2026-10-24 · score 4.3
CVE-2026-116015
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
2026-10-24 · score 4.3