Qualcomm Video Driver CVE-2025-27045
MEDIUMSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Driver interaction requires local low-privileged access (AV:L/PR:L), no user interaction; over-read discloses memory (C:H) with no integrity impact and minor availability loss (A:L).
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Information disclosure while processing batch command execution in Video driver.
AnalysisAI
Information disclosure in the Qualcomm video driver lets a local, low-privileged user read out-of-bounds memory by causing the driver to process crafted batch command execution, leaking potentially sensitive data from adjacent memory with only a minor availability impact. Affected firmware spans a broad set of Qualcomm silicon and companion parts, including FastConnect 6900/7800, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 and WSA8840/WSA8845/WSA8845H chips, as well as several X2000xxx and XG101xxx platforms. The issue requires the attacker to already hold local code execution at low privilege (AV:L/PR:L), needs no user interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.10% (1st percentile), so this is a moderate-severity, low-priority issue in practice.
Technical ContextAI
The root cause is a CWE-126 buffer over-read in the video driver's handling of batch command execution. Batch command submission lets a caller queue multiple operations together, and the driver fails to validate a length, count, or index field against the true size of the backing buffer before reading from it, so it dereferences memory past the intended boundary. Because the flaw is a read rather than a write and the CVSS scope is unchanged (S:U), the impact is confined to confidentiality (C:H) plus a small availability hit (A:L) rather than arbitrary code execution, though leaked driver or kernel memory can include pointers and other data useful for defeating ASLR as part of a larger exploit chain. The attack path is local only (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). The CPE inventory covers firmware for a wide range of Qualcomm components - FastConnect 6900/7800 connectivity, QCC2072 Bluetooth, SC8380XP (Snapdragon X Elite-class) compute, and WCD/WSA audio codecs and amplifiers - reflecting that the affected driver ships across multiple SoCs and companion chips rather than a single SKU.
RemediationAI
Patch available per vendor advisory: Qualcomm addressed CVE-2025-27045 in its October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), but because the fix ships inside firmware and vendor BSPs, exact patched build numbers are not specified here and must be obtained from the device OEM or module vendor. Apply the OEM's Android/Windows/device firmware update that incorporates the October 2025 Qualcomm fixes for the affected FastConnect, QCC2072, SC8380XP, WCD, and WSA components, and track component-level status via the OEM's own security bulletin since Qualcomm does not publish end-user installers. Where updating is not immediately possible, compensating controls should target the required local, low-privileged foothold: enforce SELinux/AppArmor or equivalent mandatory access control so that only privileged, system-owned processes can open the video driver device node and issue batch command ioctls (side effect: third-party media, camera, or display utilities that rely on direct driver access will break and may need vendor replacements); strip unnecessary permissions and untrusted apps from devices to raise the cost of obtaining the precondition (side effect: reduced functionality for sideloaded or non-vetted applications); and, on managed fleets, disable sideloading and untrusted developer options. None of these fully close the over-read, so patched OEM firmware remains the only complete fix.
More in Fastconnect 6900 Firmware
View allQualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE. Rated critical severity (CVSS 9.8), this
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today