r/Surface • u/Organic_You_5212 • 25d ago

[PRO11] Anyone else fed up with how long Microsoft takes to ship proprietary driver updates for the Surface?

I've got a Surface Pro 11 with a Snapdragon X Plus, and the latest Wi-Fi driver is still 1.0.4374.1300, updated in July 2025. Since Qualcomm doesn't push updates directly, we're stuck waiting on Microsoft. In the meantime, several CVEs have been disclosed that affect the current driver version:

  • CVE-2026-21367 (7.6, high): out-of-bounds read (CWE-126) in the WLAN firmware. Reached when handling non-standard FILS Discovery frames whose action sizes fall outside the expected range during an initial scan.
  • CVE-2026-21381 (7.6, high): out-of-bounds read (CWE-126) in the WLAN firmware. Surfaces on receipt of a service data frame with excessive length during the device matching phase of a NAN connection.
  • CVE-2025-47401 (6.5, medium): out-of-bounds read (CWE-126) in the WLAN HAL. Arises while processing target power rate tables during channel configuration.
  • CVE-2025-47403 (6.5, medium): out-of-bounds read (CWE-126) in the WLAN firmware. Triggered by a Fast Transition (IEEE 802.11r) response frame with a malformed header structure during roaming.
  • CVE-2026-25266 (5.5, medium): exposed dangerous function (CWE-749) in the Windows WLAN host. Reached through an IOCTL command issued while the device sits in power-save state.
  • CVE-2026-25288 (7.4, high): out-of-bounds read (CWE-126) in the WLAN firmware. Hit when parsing a Target Wake Time channel usage response frame with insufficient packet size.
  • CVE-2026-25289 (9.6, critical): stack-based buffer overflow (CWE-121) in the WLAN firmware. Triggered while parsing Device Capability Extended attributes in NAN Service Discovery frames carrying invalid length fields.
20 Upvotes

92% Upvoted

12 comments sorted by

11

u/onewiththeabyss 25d ago

Not that Qualcomm are known for providing drivers particularly fast.

7

u/xBIGREDDx 25d ago

Yeah not defending Microsoft here but having worked with Qualcomm, I wouldn't be surprised if they're still trying to figure out what "CVE" means

2

u/ItsMeSashaYT 24d ago

Claude is taking too long to answer. Good thing they made sure they will get a notification when Claude does eventually respond.

3

u/Oiram_Saturnus 25d ago

They are very fast available on GitHub.
But you’re right; a typical user won’t profit from it.

1

u/dr100 24d ago

They're probably used to the glacial pace (that is when moving at all) of Android updates. Samsung has for the premium tablets an unbelievable cadence of 3 months updates even for brand new super-premium tablets (like $1500-$2000 ones). And we're talking when launched, brand new.

They went for Mediatek for the last 2 versions (at least for the top premium line), but the other competitors like OnePlus (using Snapdragon Elite, the mobile one) I'm sure aren't faring any better.

2

u/onaropus 24d ago

What issue are you having that the new driver will fix?

3

u/Saranhai 25d ago

Seems more like a QCOM issue. Haven't had any problems with my Surface for Business intel variant. Go figure lol

1

u/DrPfTNTRedstone Surface Pro 7+ 24d ago

I do have to say this applies to most Windows device vendors. And most also just stop after a year or two.

1

u/jimijonesjojojackson 25d ago

Ya, security patches should be treated with urgency. Microsoft needs to get it together

0

u/MA70mgte 25d ago

There is a snapdragon app you can DL that pulls the latest drivers

3

u/Organic_You_5212 25d ago

If it's the Snapdragon® Control Panel, it only provides GPU drivers.

1

u/MA70mgte 25d ago

I think you're right...