What is the CVSS score of CVE-2025-27048?

CVE-2025-27048 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm Camera Driver are affected by CVE-2025-27048?

A high-severity privilege-escalation flaw in Qualcomm's camera platform driver firmware affects Android and other mobile or embedded devices built on affected Qualcomm chipsets, allowing code that is…

How to fix or mitigate CVE-2025-27048?

Within 24 hours, confirm which device models in the inventory use affected Qualcomm camera platform firmware and open a tracking record with Qualcomm and the device OEM (for example, OEM advisories covering Snapdragon-based handsets) since Vendor patch status is: No vendor-released patch identified at time of analysis; instruct mobility and endpoint teams not to expect a fix today and to operate on the assumption that a local attacker who achieves any low-privilege execution can escalate. Within 7 days, apply the interim mitigations in this response - tighten SELinux policy or equivalent access controls on the camera device node, strip camera permissions from non-essential applications through MDM, restrict sideloading and USB debugging, and add detection for anomalous IOCTL activity or unexpected camera-device access by unprivileged processes - and raise the priority of any pending mobile threat defense or app-vetting deployments. Within 30 days, re-check Qualcomm and OEM security bulletins for a fixed firmware or kernel image release and stage it through your normal mobile update pipeline as soon as it ships; if no patch has appeared, escalate with Qualcomm and the OEM for a remediation timeline, evaluate compensating detective controls on the highest-risk device population, and document accepted residual risk for the CISO.

Qualcomm Camera Driver CVE-2025-27048

HIGH

Untrusted Pointer Dereference (CWE-822)

2025-10-09 product-security@qualcomm.com

Buffer Overflow Qualcomm Fastconnect 6900 Firmware Fastconnect 7800 Firmware Qcc2072 Firmware Sc8380xp Firmware Wcd9378c Firmware Wcd9380 Firmware Wcd9385 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware X2000077 Firmware X2000086 Firmware X2000090 Firmware X2000092 Firmware X2000094 Firmware Xg101002 Firmware Xg101032 Firmware Xg101039 Firmware

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

IOCTL abuse requires a local unprivileged process so AV:L/PR:L; no user interaction and reliable triggering give UI:N/AC:L; kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 14:40 vuln.today

tag: Qualcomm added

Analysis Generated

Oct 08, 2026 - 14:05 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption while processing camera platform driver IOCTL calls.

AnalysisAI

Memory corruption in Qualcomm's camera platform driver firmware lets a locally-resident attacker escalate privileges from an unprivileged process to the firmware/kernel layer by supplying malformed arguments to camera driver IOCTL calls, triggering an untrusted pointer dereference (CWE-822). It is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation requires the attacker to already run code on the device as a low-privilege process that can open and issue IOCTLs against the camera device node; there is no remote attack surface and no user interaction, making this a privilege-escalation primitive rather than an initial-access vector. No public exploit identified at time of analysis, it is not listed on CISA KEV, and EPSS is 0.09% (0th percentile), reflecting the mandatory local foothold.

Technical ContextAI

The flaw resides in Qualcomm camera platform driver firmware that exposes an IOCTL interface to userspace, typically reachable through a /dev device node from a sandboxed or SELinux-confined process. CWE-822 (untrusted pointer dereference) is the root-cause class: the driver accepts a pointer or pointer-derived value from an untrusted userspace IOCTL argument and dereferences it without adequate validation, producing memory corruption that corrupts memory the attacker can influence and turning a local write primitive into code execution in the driver's elevated context. Affected targets are Qualcomm firmware builds rather than a single binary, spanning connectivity and audio/sensor companion silicon - FastConnect 6900 and 7800, QCC2072, SC8380XP, WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845, WSA8845H, and the X2000077, X2000086, X2000090, X2000092, X2000094, XG101002, XG101032 and XG101039 firmware variants, each captured as a Qualcomm firmware CPE. The local, low-privilege vector (AV:L/PR:L) and unchanged scope (S:U) mean the corruption must be leveraged within the existing driver security context; the high C/I/A ratings reflect full compromise of confidentiality, integrity and availability once the memory corruption succeeds.

RemediationAI

Apply the firmware/driver fixes published by Qualcomm in its October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) - the bulletin is the authoritative source for the exact patched firmware revision per chip; patch status is therefore 'Patch available per vendor advisory' and no independent patched version number is confirmed here. Since Qualcomm firmware is distributed through device OEMs rather than directly to end users, device owners should track their vendor's corresponding OEM security update and apply it when released; there is no user-installable Qualcomm-side workaround. Where patching is delayed, the effective compensating control is to constrain who can reach the camera driver's device node: enforce and tighten SELinux/AppArmor policy so that only privileged system components (and no third-party or sandboxed apps) can open the camera device and issue IOCTLs to it, reducing the population of processes able to reach the untrusted-pointer-dereference path. The trade-off is that over-restricting the node can break legitimate camera and media features for applications that need direct device access, so policy should be scoped to the specific /dev node and validated against normal camera operation. Keeping untrusted or sideloaded applications off the device, and preventing any untrusted code execution in the first place, removes the mandatory local foothold this privilege-escalation bug requires; note that these are mitigating measures only and not a substitute for the vendor firmware patch.