What is the CVSS score of CVE-2025-27053?

CVE-2025-27053 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm PlayReady are affected by CVE-2025-27053?

Qualcomm chipsets that incorporate the PlayReady Trusted Application are affected by a high-severity memory corruption vulnerability (CVE-2025-27053) that could allow code execution or integrity loss…

How to fix or mitigate CVE-2025-27053?

No vendor-released patch identified at time of analysis. Within 24 hours, inventory all devices using Qualcomm chipsets with the PlayReady Trusted Application and confirm exposure. Within 7 days, engage Qualcomm for patch timeline and implement compensating controls such as restricting local app privileges, enforcing app sandboxing, and monitoring for anomalous TEE activity. Within 30 days, apply the vendor patch once released, or continue mitigations if no patch is available; reassess risk based on any new exploit intelligence.

Qualcomm PlayReady CVE-2025-27053

HIGH

Incorrect Calculation of Buffer Size (CWE-131)

2025-10-09 product-security@qualcomm.com

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local app must send TA commands so AV:L and PR:L; no user interaction and reliable triggering give UI:N/AC:L; TEE memory corruption yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:05 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption during PlayReady APP usecase while processing TA commands.

AnalysisAI

Memory corruption in Qualcomm's PlayReady Trusted Application (TA) occurs when the TA processes crafted commands, and since the vulnerability is reachable only through the local trusted-execution environment it requires an attacker who can already run code on the device at app privilege level. Successful exploitation could corrupt memory within the Trusted Execution Environment and lead to code execution or integrity loss (CWE-131, Incorrect Calculation of Buffer Size), affecting a very broad range of Qualcomm chipsets across mobile, modem, IoT, automotive, compute, and wearable platforms. No public exploit code has been identified and EPSS is negligible (0.09%, 0th percentile), so this is an access-gated issue that matters most to devices that ship and rely on the affected PlayReady TA.

Technical ContextAI

PlayReady is a Microsoft DRM implementation whose device-side components on Qualcomm silicon execute inside a Trusted Application running in the Trusted Execution Environment (TEE) rather than in the normal rich OS. The affected code path handles TA command messages issued by the PlayReady app use case; because the buffer size for a command payload is calculated incorrectly (CWE-131), a malformed command can cause a write past the intended boundary - echoing the 'Buffer Overflow' tag assigned by the CNA. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack path requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impact confined to a single security scope. The CPE strings enumerate a large Qualcomm firmware portfolio - including Snapdragon mobile platforms, X-series modems, QCA connectivity chipsets, QCM/QCS IoT parts, SA automotive SoCs, and QAM access products - indicating the vulnerable PlayReady TA is shared across many chipset families rather than a single device.

RemediationAI

Qualcomm has published its October 2025 Product Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which is the authoritative source for which of the hundreds of listed chipsets are affected and for the corresponding fixed firmware/software versions; because no exact patched version is enumerated here, patch availability should be confirmed per chipset against that advisory (Patch available per vendor advisory). Device and product vendors that build on the affected Qualcomm platforms should obtain the updated PlayReady TA/firmware from Qualcomm and push it to end users; end users should apply OEM firmware updates as soon as their carrier or manufacturer releases them. Until an update is available, the practical compensating controls are constrained because the flaw lives in TEE firmware: block or tightly control installation of untrusted apps (since exploitation requires on-device code execution at app privilege and the ability to send TA commands), enforce app-store vetting and Play Integrity/attestation to detect tampered apps, and, on managed fleets, restrict sideloading and use mobile-threat-defense tooling to flag apps that interact with DRM/TEE interfaces. Disabling the PlayReady use case entirely would remove the attack surface where configuration allows it, but the trade-off is loss of protected DRM playback on that device; because the vector is local (AV:L) with no remote path, network-level filtering provides no benefit and should not be relied upon.