Qualcomm Chipset Firmware CVE-2025-27040
MEDIUMSeverity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local foothold with low privileges needed (AV:L/PR:L), no user interaction; reading hypervisor-boundary log data justifies scope change S:C and C:H with no integrity/availability impact.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Information disclosure may occur while processing the hypervisor log.
AnalysisAI
Information disclosure in Qualcomm chipset firmware (CSR8811, Immersive Home 214/216/316/318 platforms, IPQ5xxx/8xxx/9xxx, QCA/QCN wireless and modem series, and SDX55) allows a locally positioned attacker to read sensitive data when the hypervisor log is processed. The flaw stems from improper input validation (CWE-20) and requires an attacker to already hold low-level privileges on the affected SoC (CVSS: AV:L/PR:L, scope changed, high confidentiality impact, no integrity or availability impact), so it is not remotely or unauthenticated-exploitable. The EPSS score is negligible (0.08%) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
This issue resides in Qualcomm SoC firmware that handles hypervisor logging. The hypervisor runs at a privilege level above the guest/application context, and the log-processing path parses input without adequate validation. CWE-20 (Improper Input Validation) is the root-cause class: malformed or crafted input reaching the log handler is not sufficiently sanitized, enabling an information-disclosure condition in which data from the hypervisor log context can be exposed to a caller in a lower-privilege local context. The CVSS scope is marked Changed (S:C), reflecting that the vulnerable component and the impacted component differ - a local, low-privilege actor leveraging the hypervisor log path gains access to data outside their nominal authorization boundary, with a high confidentiality impact but no integrity or availability effect. The AV:L/PR:L vector confirms the attacker must already be executing locally with low privileges on the chipset; there is no network attack vector.
RemediationAI
Consult the Qualcomm October 2025 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) and apply the vendor-provided firmware updates for each affected chipset - patch available per vendor advisory, as the bulletin is the authoritative source for the specific fixed firmware builds and device OEMs must obtain updated images through their silicon/OEM channel. Because the vulnerability requires local low-privilege access on the SoC, the most effective compensating controls focus on reducing the attacker's ability to reach the hypervisor log-processing path: restrict and audit local shell/debug interfaces (e.g., adb, serial console, debug UART, JTAG) and disable them in production builds where the trade-off is loss of field-debug capability; enforce strict application sandboxing and least-privilege so a compromised lower-privilege context cannot invoke the log handler; and, where hypervisor logging is not operationally required, disable the feature, accepting reduced diagnostic visibility. Blocking network access does not mitigate this Local-vector issue and should not be relied upon; no public exploit code exists, so prioritization can follow normal vendor firmware-update cycles rather than emergency response.
More in Csr8811 Firmware
View allMemory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. Rated critical severity (
A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap
Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Com
Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdrago
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. Rated critical severity (CVSS 9.3
Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today