(Pwn2Own) Qualcomm Technologies QCA7005 GreenPhy Heap-based Buffer Overflow Code Execution Vulnerability

November 13th, 2026
ZDI-26-1008 ZDI-CAN-28952

CVE ID

CVE-2026-25293

CVSS Score

6.8 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Qualcomm Technologies

Affected Products

QCA7005

Vulnerability Details

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Qualcomm Technologies QCA7005 powerline chips. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of vendor-specific GreenPhy management messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code on the powerline communication chip.

Additional Details

Qualcomm Technologies has issued an update to correct this vulnerability. More details can be found at:
https://docs.qualcomm.com/securitybulletin/may-2026-bulletin.html

Disclosure Timeline

  • 2026-02-19 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Tobias Scharnowski (@ScepticCtf), Felix Buchmann, and Kristian Covic of Fuzzware.io

Back to Advisories