Qualcomm GreenPhy Chip Buffer Overflow Enables Code Execution with Physical Access

On November 13, 2026, Trend Micro published advisory ZDI-26-1008 covering a vulnerability in the Qualcomm QCA7005 chip, a powerline component used for communication over electrical wiring. The flaw, discovered on February 19, 2026, by Fuzzware.io researchers and presented in the Pwn2Own context, enables arbitrary code execution with only physical presence and no authentication. The assigned CVE is CVE-2026-25293, with a CVSS score of 6.8 per the Zero Day Initiative's published list.

"This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Qualcomm Technologies QCA7005 powerline chips. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-1008

How the GreenPhy Parsing Flaw Works

The technical core lies in the handling of vendor-specific GreenPhy management messages. The QCA7005 microcontroller, designed for powerline communication, accepts vendor-specific management packets without first validating the length of user-supplied data. The destination buffer, dynamically allocated on the heap with a fixed size, is overwritten beyond its boundaries during the copy operation.

The heap overflow condition is classic in structure but insidious in context: the code runs in a resource-constrained environment typical of powerline controllers, where modern mitigation mechanisms are often absent or weak. The lack of authentication on the input channel further lowers the attack threshold: anyone who can physically interface with the device has a direct path to code execution.

Why GreenPhy and Powerline Matter for Critical Infrastructure

The GreenPhy standard has emerged as a reference protocol for powerline communication in vehicle-to-grid and energy management scenarios. Qualcomm's QCA7005 chip is one of the most widely deployed controllers in this niche, integrated into energy control units, electric vehicle charging systems, and home automation devices. Powerline communication leverages existing electrical infrastructure, eliminating the need for dedicated cabling but expanding the attack surface to a shared, physically accessible medium.

The physical presence required by the exploit does not rule out high-impact scenarios. In environments where the chip is deployed, local access to electrical panels, charging stations, or terminal units is realistic for insiders, unauthorized maintenance personnel, or actors capable of compromising the supply chain. The vector is not remote, but persistence gained on a powerline communication node can become a platform for energy traffic manipulation or service disruption.

The Disclosure Chain: From February to Coordinated Release

The documented timeline shows an ordinary but extended disclosure path: the vendor report is dated February 19, 2026, with coordinated publication on November 13, 2026, roughly nine months later. This interval aligns with patch cycles for embedded components and semiconductors, where producing corrected microcode requires extensive validation. Qualcomm has released a corrective update, but sources do not specify affected firmware versions or technical details of the fix.

The assignment of CVE-2026-25293 and the CVSS 6.8 score come from the published ZDI list rather than the advisory body text, where these identifiers do not appear explicitly. The score reflects the local nature of the vector and the physical presence requirement, which moderate severity while maintaining high impact on confidentiality, integrity, and availability. No information on in-the-wild exploitation has emerged at the time of publication.

Recommended Actions

Operators managing devices with the QCA7005 chip must verify the availability of the corrective update released by Qualcomm Technologies and plan its deployment across all physically accessible units. Priority should go to powerline nodes installed in unmonitored or easily reachable locations: public charging stations, electrical panels in shared areas, terminal units at remote sites.

Organizations must inventory devices integrating the QCA7005 chip, a non-trivial task since the component is often embedded without visible labeling. They must also restrict physical access to powerline interconnection points, treating GreenPhy controllers as critical assets even when the CVSS 6.8 suggests medium severity. The physical presence requirement does not eliminate risk; it shifts it toward physical security controls and supply chain management, areas traditionally less mature than logical security.

For researchers and red teams, the vulnerability confirms that parsing of vendor-specific management messages remains a fertile attack surface in specialized controllers. Analysis of QCA7005 firmware, where available, must include verification of proper length validation in GreenPhy frames even after the patch is applied.

Frequently Asked Questions

Can the attack be executed remotely?

No. Sources explicitly state the attack requires physical presence of the operator. The vector is local, not network-based.

Which devices are actually at risk?

The advisory identifies the Qualcomm Technologies QCA7005 chip. Sources do not list specific commercial models, firmware versions, or OEM products that integrate the component.

Does the CVSS 6.8 score mean the vulnerability is not serious?

The score reflects the physical vector limitation, but the technical impact remains arbitrary code execution. In infrastructures where local access can be obtained by insiders or through physical compromise, operational risk can exceed the purely metric reading.

Sources

• zerodayinitiative.com
• zerodayinitiative.com
• zerodayinitiative.com