CVE-2025-59600
Published: 02 March 2026
Summary
CVE-2025-59600 is a high-severity Buffer Over-read (CWE-126) vulnerability in Qualcomm Fastconnect 6200 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of user-supplied data inputs to ensure they do not exceed available buffer space, preventing the memory corruption.
Implements memory safeguards like stack canaries, ASLR, and DEP to protect against exploitation of buffer overflows even if input validation fails.
Mandates identification, reporting, and patching of flaws like this buffer overflow vulnerability in Qualcomm components.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption (buffer overflow) in Qualcomm components directly enables local privilege escalation via exploitation of a privileged process/driver.
NVD Description
Memory Corruption when adding user-supplied data without checking available buffer space.
Deeper analysisAI
CVE-2025-59600 is a memory corruption vulnerability (CWE-126) that arises when user-supplied data is added without checking available buffer space. It affects components within Qualcomm products, as documented in the vendor's security bulletin.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it through low-complexity means without requiring user interaction, potentially achieving high impacts on confidentiality, integrity, and availability.
Qualcomm's March 2026 security bulletin provides details on affected products, patches, and mitigation guidance, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html.
Details
- CWE(s)