Cyber Posture

CVE-2025-59603

High

Published: 02 March 2026

Published
02 March 2026
Modified
04 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 4.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59603 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Qualcomm Sd865 5G Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates invalid user addresses to prevent improper processing that triggers out-of-bounds writes.

prevent

Implements memory protection mechanisms like address space layout randomization and data execution prevention to mitigate memory corruption exploits.

prevent

Mandates timely flaw remediation through vendor patches specifically provided for this Qualcomm memory corruption vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local memory corruption (out-of-bounds write) with low-priv access directly enables exploitation for privilege escalation to achieve arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory Corruption when processing invalid user address with nonstandard buffer address.

Deeper analysisAI

CVE-2025-59603 is a memory corruption vulnerability stemming from improper handling of an invalid user address paired with a nonstandard buffer address, classified under CWE-787 (Out-of-bounds Write). It affects components in Qualcomm products, as documented in the vendor's March 2026 security bulletin. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.

A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required. Exploitation involves triggering the memory corruption during address processing, potentially leading to high confidentiality, integrity, and availability impacts, such as arbitrary code execution, data tampering, or denial of service within the affected scope (S:U).

The Qualcomm March 2026 security bulletin provides details on mitigation, including available patches and affected versions; practitioners should consult https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html for specific remediation steps and update guidance.

Details

CWE(s)

Affected Products

qualcomm
sd865 5g firmware
all versions
qualcomm
snapdragon xr2 5g platform firmware
all versions
qualcomm
snapdragon xr2\+ gen 1 platform firmware
all versions
qualcomm
sxr2230p firmware
all versions
qualcomm
sxr2250p firmware
all versions
qualcomm
wcd9378c firmware
all versions
qualcomm
wcd9380 firmware
all versions
qualcomm
wcd9385 firmware
all versions
qualcomm
wsa8810 firmware
all versions
qualcomm
wsa8815 firmware
all versions
+19 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-21380Same product: Qualcomm Cologne
CVE-2026-21382Same product: Qualcomm Cologne
CVE-2025-47356Same product: Qualcomm Cologne
CVE-2025-47373Same product: Qualcomm Cologne
CVE-2025-47358Same product: Qualcomm Fastconnect 6900
CVE-2025-47346Same product: Qualcomm Fastconnect 6900
CVE-2025-47390Same product: Qualcomm Cologne
CVE-2025-47343Same product: Qualcomm Cologne
CVE-2026-21375Same product: Qualcomm Cologne
CVE-2025-47399Same product: Qualcomm Cologne

References