I’d like to share the results of an experimental research note on the applicability of CVE-2026-25262 (Kaspersky ICS CERT, May 2026) to a modern 64-bit ARMv9 Qualcomm platform.
**Device:** POCO F4 GT (ingres) / Snapdragon 8 Gen 1 (SM8450, Waipio).
**What was done:**
- Static analysis of the engineering Firehose loader (`xbl_s_devprg_ns.melf`) in Ghidra identified the authorization state structure at `0x6B9CD500` (critical field `0x6B9CD538`).
- A modified Sahara client (`cve_final_single`, based on B. Kerler's edl) was created to exploit the CVE and deliver the loader to an arbitrary SRAM address (`0x2211C000`) *without* signature verification.
- An additional `SAHARA_CMD_RECV_DATA` packet injected the value `5` into the `is_authenticated` field before control was transferred to Firehose.
**Result (partial success):**
- Arbitrary write to SRAM via CVE-2026-25262 is **confirmed working** on SM8450.
- The loader executes and responds to commands (`nop` succeeds), no authorization error is observed.
- Full UFS access is **not yet achieved**; `getstorageinfo` and `read` return empty responses. Two hypotheses are being investigated: (1) loading only the LOAD segments without ELF/certificate overlay, and (2) potential TrustZone/SMC dependencies.
**Why this might be interesting:**
The official Qualcomm list for CVE-2026-25262 includes only 32-bit legacy platforms. This experiment suggests that the vulnerable code path in the Boot ROM is also present on the latest flagship SoCs, widening the scope of the vulnerability.
Full article, logs, PBL status codes, and static analysis notes are available in the repository:
https://github.com/shurikgo/cve-2026-25262-sm8450-research
No full exploit code is provided; the published material is sufficient for independent verification and further research.
*This work is shared for educational and research purposes only.*
[link] [comments]
SOCIAL SHARE CARD GENERATOR