July 18, 2026

Experimental Confirmation of CVE-2026–25262 on Snapdragon 8 Gen 1 (SM8450)

1. Introduction

By shurikgo

3 min read

Qualcomm's Emergency Download Mode (EDL) and the Sahara protocol serve as a low-level interface for communicating with a device during the primary boot stage. In this mode, a device can be flashed using a programmer file (Firehose), which for most modern Xiaomi devices requires server-side authentication (EDL Auth / SLA). Without authentication, only two commands are permitted: nop and sig.

The aim of this work is to find a method to bypass Firehose authentication on a POCO F4 GT (ingres) device based on the Snapdragon 8 Gen 1 (SM8450) chipset.

2. Device Baseline Data

  • Model: POCO F4 GT (ingres)
  • SoC: Snapdragon 8 Gen 1 (SM8450, Waipio)
  • State: boot loop, only EDL mode (9008) accessible
  • Engineering firmware: FACTORY-INGRES-0209-MP_12.0
  • Programmer file: xbl_s_devprg_ns.melf
  • UFS memory: SKhynix (identified by Firehose response)

3. Description of CVE-2026–25262

CVE-2026–25262 is a Write-What-Where (CWE-123) vulnerability in the Boot ROM (PBL) of Qualcomm chipsets, discovered and published by Kaspersky ICS CERT in May 2026. The vulnerability resides in the Sahara protocol handler (SAHARA_CMD_RECV_DATA command) and allows an attacker to write arbitrary data at an arbitrary address in SRAM at a stage when the Secure World (TrustZone) has not yet been created and hardware protections are inactive.

According to the official Qualcomm list, the vulnerability has been confirmed for the following chipset families: MDM9x07, MDM9x45, MDM9x55, MDM9x65, MSM8909, MSM8916, MSM8952, SDX50.

All these platforms belong to the category of 32‑bit and 64‑bit legacy systems:

  • 32-bit (ARMv7-A, Cortex‑A7): MSM8909, MDM9x07.
  • 64-bit (ARMv8-A, Cortex‑A53): MSM8916, MSM8952, as well as modems MDM9x45, MDM9x55, and MDM9x65 (exact cores not disclosed).
  • SDX50 — a 5G modem from 2019 (used in conjunction with 64-bit ARMv8 processors).

In this study we tested the applicability of CVE-2026–25262 to a more modern 64-bit platform, the Snapdragon 8 Gen 1 (SM8450, ARMv9 architecture). The experimental results described in Section 5 show that the vulnerability mechanism is not limited to the officially confirmed list and may affect a significantly wider range of Qualcomm chips, including flagship platforms based on ARMv9.

4. Static Analysis: Identifying the Authentication Mechanism

During static analysis of the engineering programmer file xbl_s_devprg_ns.melf (ARM64, AARCH64 little-endian) using Ghidra, a global structure controlling the Firehose authentication state was identified.

Structure address: 0x6b9cd500 (returned by the factory function FUN_00138354).

Critical field: at offset 0x38 within this structure (0x6b9cd538) there is a 64-bit field whose value determines the authentication state.

Logic of the authentication dispatcher (function FUN_00109514 in module elf_4, address 0x109514):

; Load pointer to the state structure
ldr     x8, [x20, #0x940]       ; DAT_6b971940
; Check if structure is initialized
cbz     x8, LAB_ERROR
; Load field at 0x38
ldr     w9, [x8, #0x38]
; Compare with 5 (state AUTHENTICATED)
cmp     w9, #0x5
; If not equal to 5 — jump to token check
b.ne    LAB_CHECK_TOKEN
; Otherwise — immediate command execution
br      x4

Thus, to bypass authentication, it is necessary and sufficient to set the value 5 in the 0x38 field of the structure at 0x6b9cd500 before the dispatcher checks it.

5. Experimental Verification

Tool. Using the public edl tool (B. Kerler, V3.62) as a base, an experimental testbed cve_final_single was created with a modified upload_loader method. The tool performs:

  1. Standard Sahara handshake.
  2. Sending the programmer file in a single SAHARA_CMD_RECV_DATA packet with a substituted destination address (data_offset = 0x2211c000), which enables writing while bypassing signature verification.
  3. An additional SAHARA_CMD_RECV_DATA packet to write the value 5 to address 0x6b9cd538 (authentication flag injection).
  4. Completion of the Sahara phase by transferring control to the entry point (0x2211c000).

Result. The full experimental log is provided below:

Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader xbl_s_devprg_ns.melf ...
main - Device detected :)
sahara - Protocol version: 3, Version supported: 1
main - Mode detected: sahara
sahara - Reading Chip Info : OK
sahara - - Sahara version  : 3
sahara - - Chip Serial Number : 43292634bad
sahara - - OEM PKHASH : dd0cba2f3000eb65fde9932444cc05eee49aa0089f62d4828c92fe27e7888fbf18c49102464893ebed7df8d62834c6ce
sahara - Exploiting CVE-2026-25262: sending 1583628 bytes to 0x2211C000
sahara - Injecting auth flag: 8 bytes to 0x6B9CD538
sahara - Single-packet exploit sent. Firehose should start now.
main - Trying to connect to firehose loader ...
firehose - Nop succeeded.

Log analysis:

  • The PKHASH (dd0cba2f...) confirms the device's legitimacy.
  • The message Exploiting CVE-2026-25262 confirms the use of the vulnerability to deliver the Firehose into memory.
  • The message Injecting auth flag confirms the injection of the value 5 into the field at 0x6b9cd538.
  • The authentication error (Only nop and sig tag can be recevied before authentication) is not observed; the loader successfully responds to the nop command. This proves that the code is executing, although the direct effect of the flag injection on disabling authentication remains subject to further verification.

6. Current Limitations and Further Hypotheses

Despite the successful execution of the Firehose code and the absence of the authentication error, UFS access commands (getstorageinfo, read) return an empty response. The Firehose does not provide diagnostic information (TargetName, MemoryName, Version).

Two hypotheses explaining this behavior are being considered:

  1. Loading a "raw image." The current delivery method loads the entire MELF file into memory, including ELF headers and the overlay with certificates, which the Firehose does not expect to see in its address space. This could disrupt its initialization. The hypothesis suggests that loading only the LOAD segments (Segment 0 and Segment 1) without headers and certificates will restore correct Firehose initialization and UFS access.
  2. TrustZone dependency. The Firehose may use SMC calls to interact with the UFS controller via the Secure World. With CVE-based delivery, TrustZone is not initialized in the standard way, which could lead to hangs or errors when accessing the hardware. This hypothesis requires additional static analysis for SMC instructions in the Firehose code.

7. Conclusion

The applicability of CVE-2026–25262 to the Snapdragon 8 Gen 1 (SM8450) chipset has been practically confirmed. An experimental tool has been developed that allows writing arbitrary data to SRAM and loading a modified Firehose, which executes without requesting authentication. Partial success has been achieved: the Firehose code runs and responds to commands, no authentication error is observed, but UFS access has not yet been obtained. Attempts are being made to gain UFS access in line with the formulated hypotheses. The research is ongoing.

Github: https://github.com/shurikgo/cve-2026-25262-sm8450-research