Qcc7225 Firmware
Monthly
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Transient denial of service affects Qualcomm sound-platform firmware running on QCC5161, QCC7225, QCC7226, and QCC7228 Bluetooth audio chips as well as the S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms, but only when the QHS (Qualcomm High Speed) feature is enabled and multiple Bluetooth audio profiles are concurrently active. The root cause is a use-after-free (CWE-416) that surfaces under this specific concurrent-profile timing condition, producing a self-recovering (transient) loss of availability with a minor integrity side effect and no confidentiality impact. Exploitation requires an established, paired-level connection to the device (PR:L) and the QHS/multi-profile configuration to be in use; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), with EPSS at 0.17% (5th percentile) indicating low predicted exploitation likelihood. Note that the supplied NVD vector (AV:N/AC:L, 7.1) is more permissive than our assessed vector (AV:A/AC:H, PR:L), which reflects that the flaw is an adjacent-range, race-dependent condition rather than a reliably network-triggerable low-complexity issue.
Transient DOS while parsing the EPTM test control message to get the test pattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption due to global buffer overflow when a test command uses an invalid payload type. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while processing the hash segment in an MBN file. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Transient denial of service affects Qualcomm sound-platform firmware running on QCC5161, QCC7225, QCC7226, and QCC7228 Bluetooth audio chips as well as the S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms, but only when the QHS (Qualcomm High Speed) feature is enabled and multiple Bluetooth audio profiles are concurrently active. The root cause is a use-after-free (CWE-416) that surfaces under this specific concurrent-profile timing condition, producing a self-recovering (transient) loss of availability with a minor integrity side effect and no confidentiality impact. Exploitation requires an established, paired-level connection to the device (PR:L) and the QHS/multi-profile configuration to be in use; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), with EPSS at 0.17% (5th percentile) indicating low predicted exploitation likelihood. Note that the supplied NVD vector (AV:N/AC:L, 7.1) is more permissive than our assessed vector (AV:A/AC:H, PR:L), which reflects that the flaw is an adjacent-range, race-dependent condition rather than a reliably network-triggerable low-complexity issue.
Transient DOS while parsing the EPTM test control message to get the test pattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption due to global buffer overflow when a test command uses an invalid payload type. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while processing the hash segment in an MBN file. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.