CVE-2025-59609 Buffer Over-read in WLAN Host Communication
An attacker can disclose sensitive information by sending malformed MBSSID advertisement frames to Qualcomm Snapdragon WLAN hosts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59609?
CVE-2025-59609 is a medium-severity vulnerability in Qualcomm Ar8035 Firmware, published on 1 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Weakness: CWE-126
Which versions are affected by CVE-2025-59609?
It affects 187 products.
Products include Qualcomm 5g Fixed Wireless Access Platform Firmware, Qualcomm Ar8035 Firmware, Qualcomm Csr8811 Firmware, Qualcomm Fastconnect 6700 Firmware, Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware and 181 more.
How do I fix CVE-2025-59609?
Apply the vendor's patch.
Is CVE-2025-59609 being exploited?
There is no known exploitation of CVE-2025-59609 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Ar8035 Firmware
Sources
Also known as 3670476, A-465461751, GHSA-4728-c4x2-h2qm, PUB-A-465461751.