Qualcomm FastConnect
CVE-2025-27039
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
IOCTL access requires an existing local low-privileged process (AV:L, PR:L); no user interaction; dominant availability impact (A:H) with limited C/I from memory corruption.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
AnalysisAI
Memory corruption in Qualcomm firmware for FastConnect 6900/7800 connectivity chips and the WCD9380/WCD9385 codecs, WSA8830/WSA8832/WSA8835 audio amplifiers, and SXR2230P/SXR2250P platforms can be triggered when a process issues a crafted IOCTL call carrying a DMM/WARPNCC CONFIG request. The attack is local only: per the assessed CVSS vector (AV:L/PR:L/UI:N), the attacker must already hold low-privileged execution on the device, so this cannot be reached by a remote, unauthenticated attacker, and it primarily threatens system availability (A:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and EPSS is negligible at 0.08% (0th percentile); Qualcomm has published a fix in its October 2025 security bulletin, though the vulnerable firmware ships as a component that must be updated through the device or module vendor.
Technical ContextAI
The defect lives in Qualcomm firmware handling the IOCTL interface used for DMM/WARPNCC CONFIG requests, the control path through which a host-side process configures these connectivity, codec, and amplifier subsystems. The CPE data pins the exposure to specific Qualcomm firmware builds for FastConnect 6900 and 7800 (Wi-Fi/Bluetooth combo), the WCD9380 and WCD9385 audio codecs, the WSA8830, WSA8832 and WSA8835 smart speaker amplifiers, and the SXR2230P and SXR2250P platforms; all CPE entries use the wildcard version placeholder, so remediation is driven by the vendor bulletin's per-component firmware versions rather than a single global release number. NVD classifies the root cause as CWE-390 (detection of an error condition without action), meaning the code path encounters an anomalous or failed condition during request processing, does not handle or abort it, and then continues with corrupted state in a way that produces memory corruption - consistent with the vendor's and tag-level characterization of the defect as a buffer/out-of-bounds style overflow. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) confirms the memory corruption is reachable with attacker-controlled parameters through the local IOCTL surface, requires no user interaction, does not change security scope, and lands hardest on availability, which for firmware subsystems often manifests as a crash, hang, or reboot loop rather than reliable code execution.
RemediationAI
Patch available per vendor advisory: Qualcomm's October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) documents the firmware corrections for the affected FastConnect, WCD, WSA, and SXR components, and remediation is to obtain and apply the updated firmware through the OEM, carrier, or module vendor that ships these Qualcomm parts, since end users cannot flash the firmware directly. Confirm the applied build against the bulletin's per-component fix list rather than assuming a generic device update includes it. Where patching is delayed, the useful compensating control is to reduce the local attack surface: restrict installation and execution to vetted applications and processes (for example, tighten Play Protect/enterprise app allowlisting and disable side-loading on managed fleets), which removes untrusted code that could issue the malicious IOCTL - the trade-off is reduced user flexibility and potential business-app friction. On devices with configurable SELinux or kernel-level access policy, limit access to the audio/connectivity IOCTL device nodes to the privileged system services that legitimately need them, accepting that overly tight policy can break audio, Bluetooth, and Wi-Fi functionality and requires testing. Because exploitation demands pre-existing local code execution, keeping the OS and platform patched against local privilege-escalation bugs, and monitoring for abnormal device crashes or reboots, are practical secondary measures; there is no network-side mitigation, since the vector is local.
More in Fastconnect 6900 Firmware
View allQualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE. Rated critical severity (CVSS 9.8), this
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today