What is the CVSS score of CVE-2025-27054?

CVE-2025-27054 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm Firmware are affected by CVE-2025-27054?

Qualcomm firmware used across a broad range of mobile, automotive, IoT and PC devices contains an out-of-bounds write in the reboot code path that a locally present, low-privileged actor could…

How to fix or mitigate CVE-2025-27054?

Within 24 hours, confirm whether the organization's device estate includes Qualcomm-based platforms from the affected product families and ask the responsible OEM or Qualcomm account team for a formal statement on CVE-2025-27054, since no vendor-released patch has been identified at time of analysis. In parallel, restrict local unprivileged access on affected devices, enable and verify secure boot and firmware integrity attestation where supported, and alert endpoint and mobility operations teams to watch for unexpected reboots, crashes, or memory-corruption indicators in the affected subsystem. Within 7 days, inventory affected models and firmware revisions, open cases with each OEM to obtain patch timelines, and apply interim hardening such as least-privilege enforcement, removal of local interactive access for non-essential users, and integrity monitoring of license or configuration files consumed during boot. Within 30 days, deploy OEM-supplied firmware updates as they become available, re-scan the estate for unpatched devices, and refine device-replacement and lifecycle plans for any models the vendor confirms will not receive fixes.

Qualcomm Firmware CVE-2025-27054

HIGH

Out-of-bounds Write (CWE-787)

2025-10-09 product-security@qualcomm.com

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

License file is processed locally on-device so AV:L; placing/influencing the file requires low privileges (PR:L); reliable out-of-bounds write with no user interaction yields AC:L and full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:06 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption while processing a malformed license file during reboot.

AnalysisAI

Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.

Technical ContextAI

The root cause is a CWE-787 out-of-bounds write occurring in the license-file parsing logic that runs during device reboot. Rather than a runtime network or service input path, the vulnerable code consumes a license file that must be present or tampered with on the device before the reboot sequence begins; this constrains exploitation to local access with low privileges (AV:L/PR:L/UI:N) but yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H) because corruption in firmware parsing code can redirect control flow or crash the subsystem. The CPE data shows the affected code is shared across an extremely broad Qualcomm footprint, including Snapdragon mobile platforms (4 Gen 1/2, 460, 480, 662 through 8 Gen 3, Wear 1300, W5 Gen 1), modem and RF systems (SDX55/61/82/85, X32-X75 modems, 9205 LTE and 315 5G IoT modems), connectivity and Wi-Fi/Bluetooth chipsets (FastConnect 6200-7800, WCN39xx/6xxx/7xxx, QCA61xx-QCA9xxx), audio codecs (WCD93xx, WSA88xx), compute platforms (8cx/7c family, SC8180X/SC8280XP), and automotive, robotics, and video-collaboration platforms - indicating a shared firmware license-parsing component rather than an isolated product defect.

RemediationAI

Apply the fix published in the Qualcomm October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which is the vendor's authoritative source for the exact patched firmware versions per chipset; because Qualcomm ships firmware through OEMs and module makers, teams must obtain the corrected build from the device or module vendor rather than from Qualcomm directly, so remediation is 'Patch available per vendor advisory' with the exact version string to be taken from that bulletin. Where an updated build cannot be deployed immediately, the practical compensating controls are to restrict local shell and debug access on the device so that an attacker cannot obtain the low privileges required to tamper with the license file (PR:L), enforce integrity verification or read-only protection on the license-file partition and its provisioning path so a malformed file cannot be staged before reboot, and avoid or defer device reboots into the vulnerable code path until the fix is applied - accepting that these controls reduce but do not eliminate risk if a local foothold already exists. Restricting debug interfaces and license-file write access may impede legitimate provisioning and field-diagnostics workflows, so those changes should be coordinated with the operational teams that rely on them.