Qualcomm Firmware CVE-2025-27060
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SCM calls are a local on-device interface requiring some privilege (AV:L, PR:L), malformed input triggers reliably (AC:L), and secure-world corruption crosses the trust boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Memory corruption while performing SCM call with malformed inputs.
AnalysisAI
Memory corruption in the Qualcomm Secure Channel Manager (SCM) interface allows a local attacker with low-level privileges to corrupt memory by issuing a Secure Monitor Call with malformed inputs, potentially compromising the secure world. The flaw affects devices built on Qualcomm Immersive Home 214/216/316/318 platforms, IPQ5010/IPQ5028 networking SoCs, and the QCN6xxx/QCN9xxx Wi-Fi and connectivity chipset families. Exploitation requires local access and at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.8), so the primary barrier is first obtaining code execution on the target device; no public exploit code has been identified at time of analysis, and EPSS is very low at 0.09% (0th percentile), indicating a genuine but non-urgent local privilege-escalation issue rather than a remotely exploitable mass threat. Qualcomm released fixes in its October 2025 security bulletin.
Technical ContextAI
The vulnerability sits in Qualcomm's Secure Channel Manager / Secure Monitor Call (SCM) interface, the bridge through which the non-secure world requests services from the TrustZone secure world (e.g., on Snapdragon and networking SoCs). The root cause class is CWE-822 (Untrusted Pointer Dereference): the SCM handler accepts a caller-supplied structure or pointer without adequate validation, and a malformed call causes out-of-bounds access and memory corruption inside the secure environment. The CVSS scope-change (S:C) reflects that the corruption crosses the trust boundary from the calling non-secure context into the secure world, which is why confidentiality, integrity, and availability impacts are all rated High despite the local attack vector. Affected CPEs cover firmware-only entries (no version strings), confirming the issue is in Qualcomm platform firmware across Immersive Home 214/216/316/318 platforms, IPQ5010 and IPQ5028 SoCs, and the QCN6023/6024/6100/6102/6112/6122/6132/9000/9001/9002/9003/9012/9022/9024/9070/9072/9074/9100/9274 Wi-Fi/networking chips - typically found in routers, mesh access points, and embedded networking gear where an attacker who already runs code (e.g., via a separate IoT or web-management bug) could pivot into the trusted execution environment.
RemediationAI
Vendor-released patch per the Qualcomm October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which identifies the corrected firmware versions per affected chipset; no exact fix version string is available in this dataset, so obtain the chipset-specific baseline from that bulletin and apply it via your OEM's firmware update for the Immersive Home 214/216/316/318 platforms, IPQ5010/IPQ5028, and QCN6xxx/QCN9xxx devices, tracking OEM release notes since Qualcomm fixes must be re-integrated by each device vendor. Until patched firmware is deployed, the practical compensating controls are all about raising the bar for the required local foothold: disable or restrict debug and diagnostic interfaces (ADB, UART/JTAG, engineering modes, and exposed SCM test hooks) as these are common routes to the low-privileged local access this bug needs, accepting that this complicates field diagnostics; remove or harden any untrusted executable content, sideloaded apps, or third-party driver modules that could issue arbitrary SCM calls, at the cost of reduced platform flexibility; and segment and monitor the device network so a compromise of the host OS cannot be used to reach the secure-world interface. Patching the device cannot be replaced by these measures - they only reduce the probability of an attacker attaining the prerequisite local execution.
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Rated critic
Memory corruption in Qualcomm's IPQ and QCN networking firmware - spanning Immersive Home 214/216/316/318 platforms and
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. Rated high
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption when allocating and accessing an entry in an SMEM partition continuously. Rated high severity (CVSS 7.
Memory corruption when allocating and accessing an entry in an SMEM partition. Rated high severity (CVSS 7.8), this vuln
Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of th
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today