Qualcomm IPQ Firmware
CVE-2025-27059
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SCM calls are issued from on-device software so AV:L/PR:L; corruption of secure-world memory crosses the TrustZone boundary (S:C) yielding full C/I/A.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption while performing SCM call.
AnalysisAI
Memory corruption in Qualcomm's IPQ and QCN networking firmware - spanning Immersive Home 214/216/316/318 platforms and the IPQ5010/IPQ5028, QCN60xx, QCN90xx chipset families - allows a local attacker who already holds low-privileged code execution to issue a crafted SCM (Secure Channel Manager) call and trigger an out-of-range pointer offset that corrupts memory across the secure-monitor boundary. Successful exploitation gives high confidentiality, integrity and availability impact with a scope change (S:C), reflecting that corruption crosses from the normal world into TrustZone-secured context. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is very low at 0.09% (0th percentile); the practical limiting factor is that the attacker must first obtain a local, low-privileged foothold (AV:L, PR:L) on an affected device.
Technical ContextAI
The vulnerability is classified as CWE-823 (Use of an Out-of-range Pointer Offset) inside the SCM (Secure Channel Manager) interface - the call gateway that normal-world software uses to request services from the ARM TrustZone secure monitor on Qualcomm SoCs. SCM calls pass structured argument buffers between the non-secure and secure worlds; when the callee computes an offset into a caller-supplied structure or region without validating that the resulting pointer still lies within the registered/shared buffer, the secure monitor dereferences memory outside the intended range, producing the described memory corruption. Because the fault occurs on the secure side, the CVSS scope is recorded as Changed (S:C), and the impacts are rated High across confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the primitive requires local execution already running at low privilege and needs no user interaction; there is no network-reachable path. The affected firmware images are the Immersive Home 214, 216, 316 and 318 platform firmware along with IPQ5010, IPQ5028, QCN6023, QCN6024, QCN6100, QCN6102, QCN6112, QCN6122, QCN6132, QCN9000-QCN9003, QCN9012, QCN9022, QCN9024, QCN9070, QCN9072, QCN9074, QCN9100 and QCN9274 - i.e. Wi-Fi 6/6E/7 access-point, mesh and networking silicon whose firmware exposes the SCM surface to on-device code.
RemediationAI
Qualcomm published this issue in its October 2025 product security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which is the authoritative source for the affected chipset list and the fixed BSP/build identifiers - no exact fix version is stated in the supplied data, so treat this as patch-available-per-vendor-advisory and obtain the patched firmware build for your specific chipset and device from Qualcomm's OEM/ODM rather than assuming a generic update covers it. Because the defect resides in the TrustZone secure-monitor SCM path, it cannot be fixed by customer-side configuration; the only true remediation is flashing OEM firmware that incorporates the updated Qualcomm BSP, and because the CVSS vector requires local low-privileged code execution, the highest-value compensating control while waiting is to prevent the prerequisite foothold: keep the device's management interfaces off untrusted networks, disable or restrict developer/debug facilities such as ADB, UART/JTAG consoles and engineering shells, and apply vendor updates for any other locally-exploitable bug that could serve as the initial foothold. Sandboxing on-device workloads, minimizing the set of processes with access to SCM/secure-monitor interfaces, and enabling any available secure-boot and memory-protection features raise the cost of chaining to this bug, but their trade-off is reduced diagnostic capability and, for debug interfaces, loss of low-level recovery options - so restrict rather than permanently disable wherever field serviceability matters. Note that unlike the out-of-range pointer offset itself, none of these mitigations eliminate the flaw; they only deny the local access it requires.
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Rated critic
Memory corruption in the Qualcomm Secure Channel Manager (SCM) interface allows a local attacker with low-level privileg
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. Rated high
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption when allocating and accessing an entry in an SMEM partition continuously. Rated high severity (CVSS 7.
Memory corruption when allocating and accessing an entry in an SMEM partition. Rated high severity (CVSS 7.8), this vuln
Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of th
Same weakness CWE-823 – Use of Out-of-range Pointer Offset
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today