Buffer over-read in Qualcomm products - CVE-2025-27029

Vulnerability identifier: #VU110043

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27029

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN HAL. A remote attacker can perform a denial of service (DoS) attack.

QMP1000
Snapdragon 8 Gen 3 Mobile Platform
SM8750P
SM8750
SM8735
SM7635
SM6650P
SM6650
QXM8083
WCD9378
QCN9274
QCN9160
QCN9074
QCN9024
QCN9012
QCN9000
QCN6432
WCN7861
WSA8845H
WSA8845
WSA8840
WSA8835
WSA8830
WCN7881
WCN7880
QCN6422
WCN7860
WCN7750
WCN6755
WCN6650
WCN6450
WCD9395
WCD9390
IPQ9008
QCA8081
QCA8080
QCA8075
QCA0000
IPQ9574
IPQ9570
IPQ9554
IPQ9048
QCA8082
IPQ5424
IPQ5332
IPQ5312
IPQ5302
IPQ5300
Immersive Home 326 Platform
Immersive Home 3210 Platform
FastConnect 7800
QCA8084
QCA8085
QCA8101
QCA8102
QCA8111
QCA8112
QCA8384
QCA8385
QCA8386
QCF8000
QCF8001
QCN5124
QCN5224
QCN6402
QCN6412
WSA8832
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 13 2025-06-05, 14 2025-06-05, 15 2025-06-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android