# CVE-2026-25262: Qualcomm Snapdragon MSM/MDM BootROM (PBL) write-what-where flaw in Emergency Download Mode / Sahara protocol (Kaspersky ICS CERT, Black Hat Asia 2026)

> Kaspersky ICS CERT disclosed CVE-2026-25262, a CWE-123 write-what-where condition in the immutable BootROM (Primary Bootloader) of Qualcomm MDM9x07/9x45/9x65, MSM8909/8916/8952 and SDX50 chipsets. An attacker with physical access can abuse Emergency Download Mode (Sahara protocol) to bypass secure boot and run arbitrary code with maximum privileges. Qualcomm states that fixing already-manufactured devices is not possible.

- **Published:** 2026-10-31T11:29:21Z
- **Last reviewed:** 2026-10-31T11:29:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4900
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4900.png
- **ID:** TL-2026-4900
- **Severity:** MEDIUM (CVSS 6.9)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (2 shown free below)
- **CVEs:** CVE-2026-25262

## Description

CVE-2026-25262 (Kaspersky advisory KLCERT-25-012) is a memory-corruption / write-what-where condition (CWE-123) in the Primary Bootloader (PBL), i.e. the BootROM, of several Qualcomm Snapdragon MSM/MDM chipset series. NVD describes it as memory corruption while processing a crafted ELF file in the Primary Bootloader. Kaspersky's analysis places the flaw in the BootROM verification logic for file chunks during firmware upload, which lets an attacker write arbitrary data to an arbitrary address in device memory.

The attack surface is Emergency Download Mode (EDL), whose Sahara protocol is implemented directly inside the ARM PBL and therefore runs before any operating system or security control loads. In Sahara the device sends a HELLO handshake, the host selects a mode, and the host then uploads a utility program (programmer) in chunks. Exploitation requires physical access (USB) to a device in EDL mode. Per Kaspersky and Qualcomm, success bypasses the secure boot chain, gives arbitrary code execution with maximum privileges, and allows the attacker to take complete control of the modem module and to install malicious software or backdoors on the application processor. Kaspersky states that a few minutes of physical access can be enough.

Because the BootROM is mask ROM and immutable, devices already shipped cannot be patched. Qualcomm confirmed the issue, included it in its May 2026 security bulletin, and said future chips will not contain the flaw. Affected silicon is used in smartphones, vehicles (telematics), IoT and industrial devices. Realistic abuse scenarios named by Kaspersky are repair shops, customs/border inspections where a device is withheld and returned, lost-and-found scams, and insider or corporate-espionage access to a device.

Source caveats: the hunt source is the April 20, 2026 conference announcement; the CVE, chipset list and CVSS came from the Kaspersky advisory, Kaspersky blog, NVD and secondary reporting. Scoring differs by source: Qualcomm (CNA) 6.9 MEDIUM with CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H; NIST 6.3 MEDIUM; the Kaspersky advisory page lists a score of 0.0 with vector AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. A public GitHub repository for the talk (Starry2233/cve-2026-25262-poc) states it is a read-only Sahara/EDL reconnaissance harness and contains no write or exploit capability; it also lists MDM9x55 among affected chipsets, which the Kaspersky advisory does not. No in-the-wild exploitation, threat actor, or network IOC is reported in any source reviewed. BeaconBeagle was not queried because no network IOCs (IP/domain) exist for this threat.

## MITRE ATT&CK

- T1195.003 Compromise Hardware Supply Chain
- T1553 Subvert Trust Controls
- T1601 Modify System Image
- T1542 Pre-OS Boot
- T1495 Firmware Corruption

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-25262 Qualcomm EDL (VID_05C6&PID_9008) Device Enumerated on Managed Windows Host** (`TL-2026-4900-SPL-001`)

Detects a Qualcomm Emergency Download Mode (Sahara) USB device, VID_05C6&PID_9008, enumerating on a managed Windows endpoint. EDL is the only attack surface of CVE-2026-25262 (BootROM write-what-where, CWE-123); the BootROM flaw itself is invisible to host telemetry, so enumeration of a device in EDL mode is the observable precursor. Expected only on authorised repair/flash workstations.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1200, T1542, T1195.003
- **Data sources:** windows_security_6416, sysmon_registry, defender_pnp_events
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=6416 "VID_05C6&PID_9008") OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12,13,14) "VID_05C6&PID_9008")
| eval src=case(EventCode=6416,"pnp_audit_6416","sysmon_registry")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host count first_seen last_seen sources
```

### Microsoft KQL

```kql
union isfuzzy=true
(DeviceEvents
 | where Timestamp > ago(24h)
 | where ActionType == "PnpDeviceConnected"
 | where tostring(AdditionalFields) has "VID_05C6&PID_9008"
 | project Timestamp, DeviceName, ActionType, AdditionalFields, Account=InitiatingProcessAccountName),
(SecurityEvent
 | where TimeGenerated > ago(24h)
 | where EventID == 6416
 | where tostring(EventData) has "VID_05C6&PID_9008"
 | project Timestamp=TimeGenerated, DeviceName=Computer, ActionType="PnP-6416", AdditionalFields=EventData, Account=SubjectUserName)
| sort by Timestamp desc
```

### Sigma

```yaml
title: Qualcomm EDL 9008 USB Device Registered on Host (CVE-2026-25262)
id: 3f1c2a9e-6b1d-4c58-9a47-0d2e5b7a1c01
status: experimental
description: Detects registry artefacts created when a Qualcomm Emergency Download Mode (Sahara) USB device VID_05C6 PID_9008 is enumerated, the only exposed surface for the BootROM flaw CVE-2026-25262.
references:
  - https://ics-cert.kaspersky.com/vulnerabilities/qualcomm-chipsets-series-write-what-where-condition-vulnerability-in-bootrom/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-25262
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
tags:
  - attack.initial-access
  - attack.t1200
  - attack.persistence
  - attack.t1542
  - attack.t1195.003
  - cve.2026-25262
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: '\Enum\USB\VID_05C6&PID_9008'
  condition: selection
falsepositives:
  - Authorised phone/modem repair or flashing workstations
  - Firmware engineers and QA labs working with Qualcomm devices
level: medium

```

**Known false positives:**

- Authorised repair and flashing workstations legitimately enumerate 05C6:9008 devices
- Developers and QA staff recovering bricked Qualcomm-based phones, modems or IoT units

**Tuning notes:** Enable 'Audit PNP Activity' (Security 6416) and make sure the Sysmon config does not exclude HKLM\SYSTEM\CurrentControlSet\Enum\USB. Allow-list the hostnames of approved service/lab workstations via a lookup. Add other Qualcomm diagnostic PIDs only if your fleet needs them. Expect no hits on general office endpoints.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-25262 Acquisition of Sahara/EDL Tooling or Public Recon Harness via Command Line (locked: unlock with TL Creds)
- CVE-2026-25262 Firehose Programmer / Raw-Program File Staging on Endpoint (locked: unlock with TL Creds)
- CVE-2026-25262 Repeated Qualcomm EDL (9008) Connect Events Burst on a Single Host (locked: unlock with TL Creds)
- CVE-2026-25262 Qualcomm EDL 05c6:9008 USB Enumeration in Linux Kernel Log (locked: unlock with TL Creds)
- CVE-2026-25262 Sahara/EDL Client Tooling Execution on Linux Hosts (locked: unlock with TL Creds)
- CVE-2026-25262 Qualcomm HS-USB QDLoader Serial Driver Loaded on Windows Host (locked: unlock with TL Creds)
- CVE-2026-25262 Sahara/EDL Client Tooling Execution (bkerler/edl, emmcdl, QFIL, public recon harness) (locked: unlock with TL Creds)
- CVE-2026-25262 Zadig WinUSB Driver Tool Execution (EDL 05C6:9008 Driver Binding) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 15)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/Starry2233/cve-2026-25262-poc`
- URL: `hxxps://i[.]blackhat[.]com/Asia-26/Presentations/BHAS26-Kozlov-Anufrienko-Qualcom-REV01.pdf`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Kaspersky ICS CERT experts to present vulnerability in Qualcomm chips at Black Hat Asia](https://ics-cert.kaspersky.com/events/2026/04/20/kaspersky-ics-cert-experts-present-vulnerability-in-qualcomm-chips-at-black-hat-asia/)
- [KLCERT-25-012: Qualcomm chipset series. Write-what-where Condition vulnerability in BootROM](https://ics-cert.kaspersky.com/vulnerabilities/qualcomm-chipsets-series-write-what-where-condition-vulnerability-in-bootrom/)
- [Qualcomm vulnerability: phone repairs and car maintenance are no longer safe (Kaspersky blog)](https://www.kaspersky.com/blog/qualcomm-cve-2026-25262/55811/)
- [Kaspersky discovers vulnerability in Qualcomm Snapdragon chips that can lead to data loss & device compromise (press release)](https://www.kaspersky.com/about/press-releases/kaspersky-discovers-vulnerability-in-qualcomm-snapdragon-chips-that-can-lead-to-data-loss-device-compromise)
- [Black Hat Asia 2026 slides: Qualcomm BootROM - A journey through Sahara (Kozlov, Anufrienko)](https://i.blackhat.com/Asia-26/Presentations/BHAS26-Kozlov-Anufrienko-Qualcom-REV01.pdf)
- [NVD: CVE-2026-25262](https://nvd.nist.gov/vuln/detail/CVE-2026-25262)
- [Qualcomm Security Bulletin - May 2026](https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html)
- [CVE-2026-25262 read-only Sahara/EDL recon harness (GitHub, not an exploit)](https://github.com/Starry2233/cve-2026-25262-poc)
- [Kaspersky Discovers Vulnerability in Qualcomm Snapdragon Chips (SecurityMEA)](https://securitymea.com/2026/04/23/kaspersky-discovers-vulnerability-in-qualcomm-snapdragon-chips/)
- [Qualcomm Security Crisis: Unpatchable BootROM Flaw and New Critical CVEs (We speak IoT)](https://www.wespeakiot.com/qualcomm-security-crisis-unpatchable-bootrom-flaw-and-new-critical-cves-keep-iot-smartphones-and-automotive-under-pressure/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4900