Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

CVE-2026-25289 is a memory corruption vulnerability affecting Qualcomm chipsets during the processing of Device Capability Extended attributes in NAN (Neighbor Awareness Networking) Service Discovery Frames. The flaw is triggered when frames contain invalid length values, potentially allowing an attacker to corrupt memory. This type of vulnerability can lead to arbitrary code execution or denial of service depending on exploitation context. The issue was disclosed via the NVD and is detailed in Qualcomm's August 2026 Security Bulletin. NAN is a Wi-Fi protocol feature used for device discovery without requiring a traditional network connection, making this a wireless attack surface concern. The vulnerability is rated High criticality.