CVE-2025-59616

HighCVSS 7.8/10Last modified Sep 29, 2026

Description

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	FastConnect 6700; FastConnect 6900; FastConnect 7800; Molokai; Orne; Pandeiro; QCM5430; QCM6490; QMP1000; QMP2001; Qualcomm Video Collaboration VC3 Platform; SC8380XP; SD865 5G; SM6850; SM8845P; Snapdragon 460 Mobile Platform; Snapdragon 662 Mobile Platform; Snapdragon 8 Elite Gen 5; Snapdragon AR1 Gen 1 Platform; Snapdragon XR2 5G Platform

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.htmlPatch, Vendor Advisory

Timeline

Published: Jul 6, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-596177.3Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.CVE-2025-59627.7A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate t CVE-2025-59634.8The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" an CVE-2025-59646.5A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the s CVE-2025-59657.2In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization CVE-2025-59668.1Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword repo CVE-2025-596688.7Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packet CVE-2025-596695.5A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 CVE-2025-59675.3A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan N CVE-2025-596819.8An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySe CVE-2025-596826.5An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, u CVE-2025-596839.1Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office