What is the CVSS score of CVE-2025-27041?

CVE-2025-27041 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Qualcomm Video Firmware CVE-2025-27041

MEDIUM

Buffer Over-read (CWE-126)

2025-10-09 product-security@qualcomm.com

5.5

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Video packets reach firmware via an on-device process, so AV:L and PR:L; crash is reliable (AC:L); impact is availability-only transient DOS, hence C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 15:27 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

Transient DOS while processing video packets received from video firmware.

AnalysisAI

Transient denial of service in Qualcomm video firmware can be caused when a local attacker with low privileges supplies malformed video packets to the video firmware path, triggering an out-of-bounds read (CWE-126) that affects availability only. The issue affects a broad set of Qualcomm chipsets and platforms enumerated in the vendor advisory, including FastConnect, QCA, Snapdragon, and related firmware families, but exploitation requires local access and crafted packet delivery; there is no remote vector, and the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H with a base score of 5.5. No public exploit code was identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.08%, so overall priority is low-to-moderate despite the wide chipset portfolio.

Technical ContextAI

The vulnerability resides in firmware that handles video packet processing, likely within a Qualcomm media or video subsystem. CWE-126 classifies the root cause as a buffer over-read: the firmware reads beyond the bounds of a buffer when parsing or processing a crafted video packet, leading to a transient denial of service. The provided CPEs identify affected firmware for AR8035, FastConnect 6900, FastConnect 7800, QCA6174A, QCA6574AU, QCA6584AU, QCA6595AU, QCA6678AQ, QCA6688AQ, and QCA6696, while the tag set expands the scope to additional QCA, QCN, WCN, WCD, Snapdragon, and video collaboration platform firmware. Because the CVSS vector is AV:L/PR:L/UI:N, a local user with low privileges must be able to deliver the malformed packets into the video firmware path; the assessment is availability-only (C:N/I:N/A:H) and does not indicate code execution, data disclosure, or persistence.

RemediationAI

Apply the fixed firmware from Qualcomm's October 2025 security bulletin through your OEM or device vendor; the bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html is the authoritative source for patched versions and affected chipset mappings. Patch status is covered by the vendor advisory, but exact fix version strings are not included in the provided intelligence, so organizations should track OEM Android or embedded updates and verify firmware build numbers after applying. Because the vector is local with low privileges, network controls will not address the issue. Compensating controls include restricting local shell or application access on affected devices to trusted users, sandboxing or disabling untrusted apps that can submit video data to the media stack, applying least-privilege policies to prevent low-privileged processes from reaching the video firmware interface, and monitoring for unexpected media crashes or reboots; these reduce exposure but may limit legitimate video capture, playback, or testing workflows. No public exploit code or active exploitation is known, so emergency out-of-band patching is not warranted for most environments beyond normal OEM update cycles.