Critical · published August 4, 2026
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
| Product | Versions | Fixed in |
|---|---|---|
| qualcomm/sm7550p_firmware | all versions | — |
| qualcomm/sm7635p_firmware | all versions | — |
| qualcomm/sm7675_firmware | all versions | — |
| qualcomm/sm7675p_firmware | all versions | — |
| qualcomm/sm8425_firmware | all versions | — |
| qualcomm/sm8550p_firmware | all versions | — |
| qualcomm/sm8635_firmware | all versions | — |
| qualcomm/sm8635p_firmware | all versions | — |
| qualcomm/sm8650q_firmware | all versions | — |
| qualcomm/sm8735p_firmware | all versions | — |
| qualcomm/sm8750p_firmware | all versions | — |
| qualcomm/sm8845p_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_1_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_6_gen_4_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7_gen_4_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_7s_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_elite_firmware | all versions | — |
| qualcomm/snapdragon_8_elite_gen_5_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_gen_3_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8\+_gen_2_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_ar1_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_ar1\+_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_auto_5g_modem-rf_gen_2_firmware | all versions | — |
| qualcomm/snapdragon_x65_5g_modem-rf_system_firmware | all versions | — |
| qualcomm/snapdragon_x72_5g_modem-rf_system_firmware | all versions | — |
| qualcomm/snapdragon_x75_5g_modem-rf_system_firmware | all versions | — |
| qualcomm/snapdragon_wear_elite_firmware | all versions | — |
| qualcomm/srv1h_firmware | all versions | — |
| qualcomm/srv1m_firmware | all versions | — |
| qualcomm/sxr2230p_firmware | all versions | — |
| qualcomm/sxr2250p_firmware | all versions | — |
| qualcomm/sxr2330p_firmware | all versions | — |
| qualcomm/sxr2350p_firmware | all versions | — |
| qualcomm/themisto_firmware | all versions | — |
| qualcomm/wcd9340_firmware | all versions | — |
| qualcomm/wcd9370_firmware | all versions | — |
| qualcomm/wcd9371_firmware | all versions | — |
| qualcomm/wcd9375_firmware | all versions | — |
| qualcomm/xrv9209_firmware | all versions | — |
| qualcomm/ar8035_firmware | all versions | — |
| qualcomm/cologne_firmware | all versions | — |
| qualcomm/cq7790_firmware | all versions | — |
| qualcomm/cq8725s_firmware | all versions | — |
| qualcomm/cq8750m_firmware | all versions | — |
| qualcomm/fastconnect_6200_firmware | all versions | — |
| qualcomm/fastconnect_6700_firmware | all versions | — |
| qualcomm/fastconnect_6900_firmware | all versions | — |
| qualcomm/fastconnect_7800_firmware | all versions | — |
| qualcomm/fwa_gen_3_ultra_firmware | all versions | — |
| qualcomm/fwa_gen_5_elite_firmware | all versions | — |
| qualcomm/g2_gen_1_firmware | all versions | — |
| qualcomm/g3x_gen_2_firmware | all versions | — |
| qualcomm/immersive_home_3210_platform_firmware | all versions | — |
| qualcomm/immersive_home_326_platform_firmware | all versions | — |
| qualcomm/ipq5300_firmware | all versions | — |
| qualcomm/ipq5302_firmware | all versions | — |
| qualcomm/ipq5312_firmware | all versions | — |
| qualcomm/ipq5332_firmware | all versions | — |
| qualcomm/ipq9008_firmware | all versions | — |
| qualcomm/ipq9554_firmware | all versions | — |
| qualcomm/ipq9570_firmware | all versions | — |
| qualcomm/ipq9574_firmware | all versions | — |
| qualcomm/iqx5121_firmware | all versions | — |
| qualcomm/iqx7181_firmware | all versions | — |
| qualcomm/kobuk_firmware | all versions | — |
| qualcomm/lemans_au_lgit_firmware | all versions | — |
| qualcomm/lemansau_firmware | all versions | — |
| qualcomm/milos_firmware | all versions | — |
| qualcomm/milos_iot_firmware | all versions | — |
| qualcomm/molokai_firmware | all versions | — |
| qualcomm/netrani_firmware | all versions | — |
| qualcomm/networking_pro_1210_firmware | all versions | — |
| qualcomm/networking_pro_1610_firmware | all versions | — |
| qualcomm/networking_pro_610_firmware | all versions | — |
| qualcomm/networking_pro_810_firmware | all versions | — |
| qualcomm/orne_firmware | all versions | — |
| qualcomm/palawan25_firmware | all versions | — |
| qualcomm/pandeiro_firmware | all versions | — |
| qualcomm/qam8255p_firmware | all versions | — |
| qualcomm/qam8397p_firmware | all versions | — |
| qualcomm/qam8797p_firmware | all versions | — |
| qualcomm/qamsrv1h_firmware | all versions | — |
| qualcomm/qamsrv1m_firmware | all versions | — |
| qualcomm/wcd9378_firmware | all versions | — |
| qualcomm/wcd9378c_firmware | all versions | — |
| qualcomm/wcd9380_firmware | all versions | — |
| qualcomm/wcd9385_firmware | all versions | — |
| qualcomm/wcd9390_firmware | all versions | — |
| qualcomm/wcd9395_firmware | all versions | — |
| qualcomm/wcn3988_firmware | all versions | — |
| qualcomm/wcn6450_firmware | all versions | — |
| qualcomm/wcn6650_firmware | all versions | — |
| qualcomm/wcn6755_firmware | all versions | — |
| qualcomm/wcn7760_firmware | all versions | — |
| qualcomm/wcn7860_firmware | all versions | — |
| qualcomm/wcn7861_firmware | all versions | — |
| qualcomm/wcn7880_firmware | all versions | — |
| qualcomm/wcn7881_firmware | all versions | — |
| qualcomm/wsa8810_firmware | all versions | — |
| qualcomm/wsa8815_firmware | all versions | — |
| qualcomm/wsa8830_firmware | all versions | — |
| qualcomm/wsa8832_firmware | all versions | — |
| qualcomm/wsa8835_firmware | all versions | — |
| qualcomm/wsa8840_firmware | all versions | — |
| qualcomm/wsa8845_firmware | all versions | — |
| qualcomm/wsa8845h_firmware | all versions | — |
| qualcomm/wsa8850_firmware | all versions | — |
| qualcomm/wsa8850w_firmware | all versions | — |
| qualcomm/wsa8855c_firmware | all versions | — |
| qualcomm/x1e80100_firmware | all versions | — |
| qualcomm/x2000077_firmware | all versions | — |
| qualcomm/x2000086_firmware | all versions | — |
| qualcomm/x2000090_firmware | all versions | — |
| qualcomm/x2000092_firmware | all versions | — |
| qualcomm/x2000094_firmware | all versions | — |
| qualcomm/xg101002_firmware | all versions | — |
| qualcomm/xg101032_firmware | all versions | — |
| qualcomm/xg101039_firmware | all versions | — |
| qualcomm/xrv7209_firmware | all versions | — |
| qualcomm/qca0000_firmware | all versions | — |
| qualcomm/qca6391_firmware | all versions | — |
| qualcomm/qca6554a_firmware | all versions | — |
| qualcomm/qca6564au_firmware | all versions | — |
| qualcomm/qca6574_firmware | all versions | — |
| qualcomm/qca6574a_firmware | all versions | — |
| qualcomm/qca6574au_firmware | all versions | — |
| qualcomm/qca6584au_firmware | all versions | — |
| qualcomm/qca6595_firmware | all versions | — |
| qualcomm/qca6595au_firmware | all versions | — |
| qualcomm/qca6678aq_firmware | all versions | — |
| qualcomm/qca6688aq_firmware | all versions | — |
| qualcomm/qca6696_firmware | all versions | — |
| qualcomm/qca6698aq_firmware | all versions | — |
| qualcomm/qca6698au_firmware | all versions | — |
| qualcomm/qca6777aq_firmware | all versions | — |
| qualcomm/qca6787aq_firmware | all versions | — |
| qualcomm/qca6797aq_firmware | all versions | — |
| qualcomm/qca8075_firmware | all versions | — |
| qualcomm/qca8081_firmware | all versions | — |
| qualcomm/qca8082_firmware | all versions | — |
| qualcomm/qca8084_firmware | all versions | — |
| qualcomm/qca8085_firmware | all versions | — |
| qualcomm/qca8337_firmware | all versions | — |
| qualcomm/qca8386_firmware | all versions | — |
| qualcomm/qca8695au_firmware | all versions | — |
| qualcomm/qcc2073_firmware | all versions | — |
| qualcomm/qcc2076_firmware | all versions | — |
| qualcomm/qcc710_firmware | all versions | — |
| qualcomm/qcf8000_firmware | all versions | — |
| qualcomm/qcf8001_firmware | all versions | — |
| qualcomm/qcn5124_firmware | all versions | — |
| qualcomm/qcn6224_firmware | all versions | — |
| qualcomm/qcn6274_firmware | all versions | — |
| qualcomm/qcn6402_firmware | all versions | — |
| qualcomm/qcn6412_firmware | all versions | — |
| qualcomm/qcn6422_firmware | all versions | — |
| qualcomm/qcn6432_firmware | all versions | — |
| qualcomm/qcn9000_firmware | all versions | — |
| qualcomm/qcn9011_firmware | all versions | — |
| qualcomm/qcn9012_firmware | all versions | — |
| qualcomm/qcn9024_firmware | all versions | — |
| qualcomm/qcn9274_firmware | all versions | — |
| qualcomm/qcs6690_firmware | all versions | — |
| qualcomm/qfw7114_firmware | all versions | — |
| qualcomm/qfw7124_firmware | all versions | — |
| qualcomm/qln1083bd_firmware | all versions | — |
| qualcomm/qln1086bd_firmware | all versions | — |
| qualcomm/qmb715_firmware | all versions | — |
| qualcomm/qmp1000_firmware | all versions | — |
| qualcomm/qmp2001_firmware | all versions | — |
| qualcomm/qpa1083bd_firmware | all versions | — |
| qualcomm/qpa1086bd_firmware | all versions | — |
| qualcomm/qxm1083_firmware | all versions | — |
| qualcomm/qxm1086_firmware | all versions | — |
| qualcomm/qxm1093_firmware | all versions | — |
| qualcomm/qxm1094_firmware | all versions | — |
| qualcomm/qxm1095_firmware | all versions | — |
| qualcomm/qxm1096_firmware | all versions | — |
| qualcomm/sa7255p_firmware | all versions | — |
| qualcomm/sa7775p_firmware | all versions | — |
| qualcomm/sa8255p_firmware | all versions | — |
| qualcomm/sa8620p_firmware | all versions | — |
| qualcomm/sa8770p_firmware | all versions | — |
| qualcomm/sa9000p_firmware | all versions | — |
| qualcomm/sar1165p_firmware | all versions | — |
| qualcomm/sar2130p_firmware | all versions | — |
| qualcomm/sc8380xp_firmware | all versions | — |
| qualcomm/sdx65m_firmware | all versions | — |
| qualcomm/sdx81_firmware | all versions | — |
| qualcomm/sm6450p_firmware | all versions | — |
| qualcomm/sm6475p_firmware | all versions | — |
| qualcomm/sm6475q_firmware | all versions | — |
| qualcomm/sm6650p_firmware | all versions | — |
| qualcomm/sm6850_firmware | all versions | — |
| qualcomm/sm7425_firmware | all versions | — |
| qualcomm/sm7435_firmware | all versions | — |
| qualcomm/sm7435p_firmware | all versions | — |
| qualcomm/sm7525_firmware | all versions | — |
| qualcomm/sm7550_firmware | all versions | — |