Skip to navigation

Threat reportVulnerabilityTL-2026-4900

CVE-2026-25262: Qualcomm Snapdragon MSM/MDM BootROM (PBL) write-what-where flaw in Emergency Download Mode / Sahara protocol (Kaspersky ICS CERT, Black Hat Asia 2026)

mediumMONITORING

Kaspersky ICS CERT disclosed CVE-2026-25262, a CWE-123 write-what-where condition in the immutable BootROM (Primary Bootloader) of Qualcomm MDM9x07/9x45/9x65, MSM8909/8916/8952 and SDX50 chipsets. An attacker with physical access can abuse Emergency Download Mode (Sahara protocol) to bypass secure boot and run arbitrary code with maximum privileges. First disclosed .

Key facts for Qualcomm Sahara BootROM flaw

IdentifiersTL-2026-4900, CVE-2026-25262
Also known asKLCERT-25-012, Qualcomm BootROM: A journey through Sahara
SeverityMEDIUM
CVSS6.9 (CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
First disclosed
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2026-25262: 0.1% (2.9th percentile)
Affected productsQualcomm Snapdragon MDM9x07, MDM9x45, MDM9x65 modem chipset series (BootROM/PBL); Qualcomm Snapdragon MSM8909, MSM8916, MSM8952 chipset series (BootROM/PBL); Qualcomm Snapdragon SDX50 chipset series (BootROM/PBL)
Weaknesses (CWE)CWE-123
ToolsZadig, bkerler/edl
MITRE ATT&CK techniquesT1195.003 Compromise Hardware Supply Chain, T1495 Firmware Corruption, T1542 Pre-OS Boot, T1553 Subvert Trust Controls, T1601 Modify System Image
MotivationUNKNOWN
Target sectorsautomotive, telecoms, iot, industrial, consumer-electronics
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Qualcomm Sahara BootROM flaw

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4900 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-25262 Qualcomm EDL (VID_05C6&PID_9008) Device Enumerated on Managed Windows Host

Detects a Qualcomm Emergency Download Mode (Sahara) USB device, VID_05C6&PID_9008, enumerating on a managed Windows endpoint. EDL is the only attack surface of CVE-2026-25262 (BootROM write-what-where, CWE-123); the BootROM flaw itself is invisible to host telemetry, so enumeration of a device in EDL mode is the observable precursor. Expected only on authorised repair/flash workstations.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1200, T1542, T1195.003
  • Data sources: windows_security_6416, sysmon_registry, defender_pnp_events
  • Severity: medium
  • Confidence: high

Splunk SPL

(index=wineventlog sourcetype="WinEventLog:Security" EventCode=6416 "VID_05C6&PID_9008") OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12,13,14) "VID_05C6&PID_9008")
| eval src=case(EventCode=6416,"pnp_audit_6416","sysmon_registry")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host count first_seen last_seen sources

Microsoft KQL

union isfuzzy=true
(DeviceEvents
 | where Timestamp > ago(24h)
 | where ActionType == "PnpDeviceConnected"
 | where tostring(AdditionalFields) has "VID_05C6&PID_9008"
 | project Timestamp, DeviceName, ActionType, AdditionalFields, Account=InitiatingProcessAccountName),
(SecurityEvent
 | where TimeGenerated > ago(24h)
 | where EventID == 6416
 | where tostring(EventData) has "VID_05C6&PID_9008"
 | project Timestamp=TimeGenerated, DeviceName=Computer, ActionType="PnP-6416", AdditionalFields=EventData, Account=SubjectUserName)
| sort by Timestamp desc

Sigma

title: Qualcomm EDL 9008 USB Device Registered on Host (CVE-2026-25262)
id: 3f1c2a9e-6b1d-4c58-9a47-0d2e5b7a1c01
status: experimental
description: Detects registry artefacts created when a Qualcomm Emergency Download Mode (Sahara) USB device VID_05C6 PID_9008 is enumerated, the only exposed surface for the BootROM flaw CVE-2026-25262.
references:
  - https://ics-cert.kaspersky.com/vulnerabilities/qualcomm-chipsets-series-write-what-where-condition-vulnerability-in-bootrom/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-25262
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
tags:
  - attack.initial-access
  - attack.t1200
  - attack.persistence
  - attack.t1542
  - attack.t1195.003
  - cve.2026-25262
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: '\Enum\USB\VID_05C6&PID_9008'
  condition: selection
falsepositives:
  - Authorised phone/modem repair or flashing workstations
  - Firmware engineers and QA labs working with Qualcomm devices
level: medium

Known false positives:

  • Authorised repair and flashing workstations legitimately enumerate 05C6:9008 devices
  • Developers and QA staff recovering bricked Qualcomm-based phones, modems or IoT units

Tuning notes: Enable 'Audit PNP Activity' (Security 6416) and make sure the Sysmon config does not exclude HKLM\SYSTEM\CurrentControlSet\Enum\USB. Allow-list the hostnames of approved service/lab workstations via a lookup. Add other Qualcomm diagnostic PIDs only if your fleet needs them. Expect no hits on general office endpoints.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CVE-2026-25262 Acquisition of Sahara/EDL Tooling or Public Recon Harness via Command Line · unlock with TL Creds
  • CVE-2026-25262 Firehose Programmer / Raw-Program File Staging on Endpoint · unlock with TL Creds
  • CVE-2026-25262 Repeated Qualcomm EDL (9008) Connect Events Burst on a Single Host · unlock with TL Creds
  • CVE-2026-25262 Qualcomm EDL 05c6:9008 USB Enumeration in Linux Kernel Log · unlock with TL Creds
  • CVE-2026-25262 Sahara/EDL Client Tooling Execution on Linux Hosts · unlock with TL Creds
  • CVE-2026-25262 Qualcomm HS-USB QDLoader Serial Driver Loaded on Windows Host · unlock with TL Creds
  • CVE-2026-25262 Sahara/EDL Client Tooling Execution (bkerler/edl, emmcdl, QFIL, public recon harness) · unlock with TL Creds
  • CVE-2026-25262 Zadig WinUSB Driver Tool Execution (EDL 05C6:9008 Driver Binding) · unlock with TL Creds

Indicators of compromise for Qualcomm Sahara BootROM flaw

As of 2026-10-31, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-4900.

Sample indicators (2 of 15)

  • URL: hxxps://github[.]com/Starry2233/cve-2026-25262-poc
  • URL: hxxps://i[.]blackhat[.]com/Asia-26/Presentations/BHAS26-Kozlov-Anufrienko-Qualcom-REV01.pdf

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

15 indicators of compromise · unlock with TL Creds. Compare plans

How Qualcomm Sahara BootROM flaw works

Qualcomm states that fixing already-manufactured devices is not possible.

CVE-2026-25262 (Kaspersky advisory KLCERT-25-012) is a memory-corruption / write-what-where condition (CWE-123) in the Primary Bootloader (PBL), i.e. the BootROM, of several Qualcomm Snapdragon MSM/MDM chipset series. NVD describes it as memory corruption while processing a crafted ELF file in the Primary Bootloader. Kaspersky's analysis places the flaw in the BootROM verification logic for file chunks during firmware upload, which lets an attacker write arbitrary data to an arbitrary address in device memory.

The attack surface is Emergency Download Mode (EDL), whose Sahara protocol is implemented directly inside the ARM PBL and therefore runs before any operating system or security control loads. In Sahara the device sends a HELLO handshake, the host selects a mode, and the host then uploads a utility program (programmer) in chunks. Exploitation requires physical access (USB) to a device in EDL mode. Per Kaspersky and Qualcomm, success bypasses the secure boot chain, gives arbitrary code execution with maximum privileges, and allows the attacker to take complete control of the modem module and to install malicious software or backdoors on the application processor. Kaspersky states that a few minutes of physical access can be enough.

Because the BootROM is mask ROM and immutable, devices already shipped cannot be patched. Qualcomm confirmed the issue, included it in its May 2026 security bulletin, and said future chips will not contain the flaw. Affected silicon is used in smartphones, vehicles (telematics), IoT and industrial devices. Realistic abuse scenarios named by Kaspersky are repair shops, customs/border inspections where a device is withheld and returned, lost-and-found scams, and insider or corporate-espionage access to a device.

Source caveats: the hunt source is the April 20, 2026 conference announcement; the CVE, chipset list and CVSS came from the Kaspersky advisory, Kaspersky blog, NVD and secondary reporting. Scoring differs by source: Qualcomm (CNA) 6.9 MEDIUM with CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H; NIST 6.3 MEDIUM; the Kaspersky advisory page lists a score of 0.0 with vector AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. A public GitHub repository for the talk (Starry2233/cve-2026-25262-poc) states it is a read-only Sahara/EDL reconnaissance harness and contains no write or exploit capability; it also lists MDM9x55 among affected chipsets, which the Kaspersky advisory does not. No in-the-wild exploitation, threat actor, or network IOC is reported in any source reviewed. BeaconBeagle was not queried because no network IOCs (IP/domain) exist for this threat.

MITRE ATT&CK techniques by tactic:

Initial Access

T1195.003 Compromise Hardware Supply Chain

Impact

T1495 Firmware Corruption

Persistence

T1542 Pre-OS Boot

defense-impairment

T1553 Subvert Trust Controls; T1601 Modify System Image

Remediation for Qualcomm Sahara BootROM flaw

Patches

  • No patch is possible for already-manufactured devices because the BootROM is immutable mask ROM (Qualcomm); see Qualcomm May 2026 Security Bulletin for the vendor entry

Immediate actions

  • Maintain strict physical control of devices that use affected Qualcomm chipsets (phones, modems, telematics units, IoT/industrial gateways)
  • Use only authorized service centers for repair and maintenance; treat devices returned from repair shops, customs inspections or lost-and-found as potentially tampered
  • Monitor devices for unusual behavior, including unexpected heat generation (Kaspersky mitigation guidance)
  • Inventory fleet assets for MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952 and SDX50 based modems

Workarounds

  • Restrict USB/physical port access to affected devices where possible
  • Power cycling clears non-persistent malware per Kaspersky guidance; persistent implants require reflash or hardware replacement
  • Keep device firmware updated to reduce other attack paths (Kaspersky guidance)

Longer-term hardening

  • Plan hardware refresh for long-lived deployments (vehicles, industrial IoT) that rely on affected chipsets
  • Prefer chips released after Qualcomm's fix; Qualcomm has promised future chips without this flaw
  • Add physical-security and tamper-evidence controls to the device lifecycle (supply chain, field service, decommissioning)

Affected and fixed versions

  • Qualcomm — Snapdragon MDM9x07, MDM9x45, MDM9x65 modem chipset series (BootROM/PBL)
    Vulnerable versions: All versions shipped to date
  • Qualcomm — Snapdragon MSM8909, MSM8916, MSM8952 chipset series (BootROM/PBL)
    Vulnerable versions: All versions shipped to date
  • Qualcomm — Snapdragon SDX50 chipset series (BootROM/PBL)
    Vulnerable versions: All versions shipped to date

Timeline of Qualcomm Sahara BootROM flaw

  • locked-ioc-4 reports the BootROM flaw to locked-ioc-6 (March 2025; exact day not stated in sources)
  • locked-ioc-4 publishes advisory KLCERT-25-012 (CVE-2026-25262) and announces its Black Hat Asia talk
  • Black Hat Asia 2026 opens in Singapore (April 21-24)
  • Alexander Kozlov and Sergey Anufrienko present 'locked-ioc-6 BootROM: A journey through Sahara' at Black Hat Asia 2026
  • locked-ioc-6 lists CVE-2026-25262 in its May 2026 security bulletin (day not stated in sources); states already-made devices cannot be fixed and future chips will not be affected
  • NVD publishes CVE-2026-25262 (NIST 6.3 MEDIUM; locked-ioc-6 CNA 6.9 MEDIUM)

Sources cited for Qualcomm Sahara BootROM flaw

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats