CVE-2026-57546

Executive Summary

CVE-2026-57546 is a remotely triggerable denial-of-service vulnerability (CVSS 7.5, CWE-126 — Buffer Over-read) in Qualcomm's Congo firmware, caused by improper handling of a continuous receive command that carries a zero-sized global configuration override. An unauthenticated network attacker can exploit the fault to force a crash or hang of the affected device, degrading or eliminating availability (CVSS impact subscore A:H) without any confidentiality or integrity loss. The vulnerability is currently UNPATCHED — no vendor fix, affected-version range, or workaround has been published, and no exploit code exists in public repositories, though EPSS (0.00263, ~16.6th percentile) indicates low but non-zero near-term exploitation probability.

Technical Analysis

CVE-2026-57546 resides in the "Congo" firmware component and manifests as a transient denial of service when the device processes a continuous receive command that embeds a zero-sized global configuration override. The assigned weakness is CWE-126, "Buffer Over-read," which describes a condition in which a program reads data past the end, or before the beginning, of an allocated memory buffer. In embedded firmware handling network-received command structures, this class of defect typically arises when a length or size field supplied by the peer is trusted and used to index or iterate a buffer without adequate bounds validation.

The attack surface is the network-facing command parser of the Congo firmware. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the vulnerable code path is reachable remotely and without authentication, and the attacker requires no special conditions to trigger it. The vector also records S:U (no scope change — the impact is confined to the vulnerable component) and C:N/I:N/A:H (availability-only impact), which is consistent with a crash/DoS resulting from an out-of-bounds memory access rather than code execution or data disclosure.

The specific trigger is the combination of (a) a "continuous receive" command and (b) a "zero-sized global configuration override." A zero-sized override strongly implies that a size or length value of zero propagates into a routine that later over-reads a buffer — for example, when the parser attempts to copy, compare, or hash a number of bytes derived from a field that has been set to zero, and a downstream bound check either is bypassed, underflows, or fails to account for the zero case. This mismatch between the declared size (zero) and the actual buffer/processing expectation produces the transient fault that terminates or stalls the firmware's handling thread.

It is important to state the limits of the available evidence. The CNA title field is empty, no affected version range is provided, no patch or advisory is referenced, and no public PoC code or Nuclei template exists. Consequently, no specific function name, class name, URL endpoint, API path, file path, or parameter name can be attributed to this issue from the supplied data. The analysis above is derived strictly from the NVD description (transient DoS on continuous receive with a zero-sized global configuration override) and the assigned CWE (buffer over-read); implementation-level identifiers are not available and are not invented here.

Relevant architectural context: Qualcomm firmware ("Congo") is commonly deployed in constrained, long-running embedded endpoints — representative of connectivity, networking, and IoT-class devices — where a firmware crash implies loss of the device's network function rather than a fully rebooting, easily recoverable host. This raises the operational value of the bug to an adversary seeking to disrupt connectivity.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-57546; the attack chain below is inferred from the vulnerability class (CWE-126 buffer over-read) and the NVD description, and is described at the vulnerability-class level without fabricating implementation specifics.

1. Reconnaissance / target identification. The attacker identifies geographically or logically reachable devices running the affected Congo firmware. Because the vulnerability is network-reachable (AV:N) and requires no privileges (PR:N) or user interaction (UI:N), discovery is limited to locating a device whose command interface accepts a "continuous receive" command and a "global configuration override" parameter — the exact transport (e.g., a proprietary management port or protocol) is not specified in the available data and must be determined by the defender via firmware RE or protocol documentation.

2. Triggering the flaw. The attacker crafts a command sequence in which a "continuous receive" command is issued together with a "global configuration override" whose size is zero. The zero length value is not validated as a special/degenerate case, so the firmware proceeds into a routine that reads from a buffer using the zero (or zero-derived) size — an over-read that violates memory bounds. Because the operation is transient, a single malformed message (or a short burst) is sufficient to induce the fault.

3. Payload / execution method at the class level. This is a memory-safety / malformed-input attack, not a code-execution primitive. The "payload" is an otherwise well-formed protocol message with a manipulated length field (size = 0) in the configuration-override portion of a continuous receive request. No shellcode, ROP chain, or authentication bypass is required or implied by the available data.

4. Post-exploitation impact. Successful triggering produces a transient denial of service — the device's command-processing path crashes or hangs and its network function becomes unavailable (A:H). There is no confidentiality or integrity impact (C:N/I:N). Repeated or automated re-sending of the triggering message can sustain the outage, converting a "transient" fault into a persistent denial of service against the targeted device.

Impact Assessment

CVSS 3.1 base score 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The dominant metric is A:H — total loss of availability of the affected component while the attack is in progress. The absence of C and I impact means the flaw is not a data-exfiltration or tampering primitive. S:U indicates the impact does not cross a security boundary; a crash may be recoverable by the device's own watchdog or restart logic, which is why the NVD calls the DoS "transient."

Business impact: for enterprises running networks of Qualcomm/Congo-based embedded devices, a remote, unauthenticated, repeatable availability fault is operationally significant. It can disrupt connectivity and telemetry, cause service-level degradation, and — if weaponized at scale (mass malformed messages) — impose cascading outages across a fleet. Because no authentication or user action is required, the barrier to exploitation is low, even though public exploit tooling is absent. The EPSS score of 0.00263 (~16.6th percentile) suggests exploitation is not currently observed in the wild, and the absence of a CISA KEV listing reinforces the "not actively exploited at time of writing" assessment — but CVSS-severity metrics alone justify prioritized remediation. Blast radius is bounded by the number of reachable, affected devices; any network segment hosting such devices should treat them as a DoS-exposed asset class.

Detection Guidance

Detection must account for the fact that the exact wire protocol and field names are not published. The rules below detect the vulnerability class — anomalous/frequent continuous-receive traffic carrying zero-length or degenerate configuration overrides, and firmware crash/restart telemetry — and should be tuned to the actual protocol once reverse-engineered.

Sigma Rule

title: Qualcomm Congo Firmware DoS - Zero-Sized Global Config Override in Continuous Receive
id: 3d7f1a40-9c2b-4e77-9a10-c5b8f0re1cve
status: experimental
description: Detects crash/restart or fault telemetry consistent with CVE-2026-57546 (transient DoS from a continuous receive command carrying a zero-sized global configuration override).
logsource:
  product: qualcomm
  service: firmware
detection:
  selection_fault:
    event:
      - "congo_fault"
      - "recv_cmd_error"
      - "cfg_override_error"
    message|contains:
      - "zero size"
      - "zero-length"
      - "buffer overread"
      - "continuous receive"
  selection_cmd:
    cmd_type: "continuous_receive"
    override_size: 0
  condition: selection_fault or selection_cmd
fields:
  - device_id
  - src_ip
  - cmd_type
  - override_size
falsepositives:
  - Legitimate zero-length configuration resets sent by management tooling
level: high
tags:
  - attack.t1499
  - cve.2026.57546

YARA Rule

rule CVE_2026_57546_Qualcomm_Congo_ZeroSize_Override
{
    meta:
        description = "Detects firmware images/strings consistent with CVE-2026-57546 Congo continuous receive / global config override handling"
        author = "Threat Intel"
        reference = "CVE-2026-57546"
        severity = "high"
    strings:
        $cmd  = "continuous receive" ascii nocase wide
        $cfg  = "global configuration override" ascii nocase wide
        $cfg2 = "global_config_override" ascii nocase wide
        $congo = "congo" ascii nocase wide
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        or (2 of ($cmd, $cfg, $cfg2) and $congo)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-57546 Qualcomm Congo Firmware Zero-Sized Global Config Override DoS Attempt"; flow:to_server,established; content:"|00 00|"; byte_test:2,=,0,0,relative; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; sid:2026575460; rev:1; reference:cve,2026-57546; metadata:affected_product Qualcomm_Congo, attack_target IoT_Device, deployment Perimeter, signature_severity Major, created_at 2026, updated_at 2026;)

Note: The exact protocol framing is not published; the above detects repeated zero-length-field messages to the management interface and must be adjusted to the device's real transport port and byte offsets once determined.

Elastic Detection

process where event.category == "network" and
  network.direction == "inbound" and
  event.action == "command_received"
and (
  (contains(network.protocol, "congo") and string(process.args) like "*continuous_receive*") or
  (process.name like "*congo*" and string(event.original) like "*override_size\":0*")
)

Splunk SPL Query

index=firmware OR index=network sourcetype=qualcomm:congo:*
| search (cmd_type="continuous_receive") OR (override_size=0) OR ("zero size" OR "buffer overread" OR "congo fault")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(src_ip) as sources by device_id, cmd_type, override_size
| where count > 3
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

Wazuh OSSEC Rule

<group name="qualcomm,congo,cve-2026-57546,">
  <rule id="575460" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">congo</field>
    <match>continuous_receive|global configuration override|zero size|buffer overread</match>
    <description>CVE-2026-57546: Qualcomm Congo firmware DoS condition - zero-sized global configuration override in continuous receive command.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
  <rule id="575461" level="12" frequency="5" timeframe="10">
    <if_matched_sid>575460</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-57546: Repeated Congo firmware fault from same source - probable sustained DoS attempt.</description>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, affected-version range, or official workaround is available. The following are defensive controls until an official patch is released.

1. Immediate mitigations:

   • Network-segment and firewall the management/command interface of Congo-based devices so it is reachable only from trusted, authenticated administrative hosts — this directly counters the AV:N/PR:N attack precondition.
   • Disable or restrict any "continuous receive" / remote configuration-override capability that is not strictly required.
   • Deploy the detection rules above at network and host boundaries; rate-limit and alert on repeated malformed/zero-length command messages.
   • Where available, enable device watchdog/auto-recovery so a transient fault does not escalate into prolonged outage, and mirror/monitor device restart logs for unexpected reboots.

2. Patch / upgrade steps:

   • Monitor Qualcomm security advisories and the product OEM for a fixed firmware release; subscribe to vendor security bulletins for the Congo component. Because no fix currently exists, no version-based upgrade path can be specified — treat any future vendor firmware as the remediation and validate the CVE ID against the release notes before deploying.

3. Long-term hardening:

   • Enforce strict length/size validation in all remote command parsers, explicitly rejecting degenerate values such as zero-sized overrides (addresses the CWE-126 root cause).
   • Adopt memory-safe parsing patterns and bounds-checked buffer handling; add fuzz testing of the command interface with edge-case length fields.
   • Maintain an accurate device inventory and firmware-version register so affected endpoints can be patched rapidly once a fix appears; apply network micro-segmentation to limit the DoS blast radius.

References

1. NVD — CVE-2026-57546: https://nvd.nist.gov/vuln/detail/CVE-2026-57546
2. MITRE CWE-126 — Buffer Over-read: https://cwe.mitre.org/data/definitions/126.html
3. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. FIRST EPSS — CVE-2026-57546 score page: https://api.first.org/data/v1/epss?cve=CVE-2026-57546
5. CISA Known Exploited Vulnerabilities Catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-57546 is NOT currently listed.

Threat-actor/exploit-in-the-wild note: No CISA KEV entry, no public exploit code, and no public PoC were found; EPSS (0.00263, ~16.6th percentile) indicates low near-term exploitation likelihood. No named threat-actor campaign is associated with this CVE in available data.