CVE-2025-27076

Q: What is the severity of CVE-2025-27076?

CVE-2025-27076 has a CVSS score of 7.8 (HIGH). This CVE describes a memory corruption vulnerability in Qualcomm components that occurs when processing simultaneous requests via an escape path. Successful exploitation could allow attackers to execute arbitrary code or cause denial of service. This affects systems using vulnerable Qualcomm chipsets and drivers.

7.8 HIGH

📋 TL;DR

This CVE describes a memory corruption vulnerability in Qualcomm components that occurs when processing simultaneous requests via an escape path. Successful exploitation could allow attackers to execute arbitrary code or cause denial of service. This affects systems using vulnerable Qualcomm chipsets and drivers.

💻 Affected Systems

Products:

Qualcomm chipsets and associated drivers

Versions: Specific versions not detailed in reference; check Qualcomm advisory

Operating Systems: Android, Linux-based systems using Qualcomm components

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems with Qualcomm hardware and vulnerable driver versions

📦 What is this software?

Snapdragon 7c Gen 2 Compute Platform \(sc7180 Ad\) \"rennell Pro\" Firmware by Qualcomm

View all CVEs affecting Snapdragon 7c Gen 2 Compute Platform \(sc7180 Ad\) \"rennell Pro\" Firmware →

Snapdragon 7c\+ Gen 3 Compute Firmware by Qualcomm

View all CVEs affecting Snapdragon 7c\+ Gen 3 Compute Firmware →

Snapdragon 8c Compute Platform \(sc8180x Ad\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8c Compute Platform \(sc8180x Ad\) Firmware →

Snapdragon 8c Compute Platform \(sc8180xp Ad\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8c Compute Platform \(sc8180xp Ad\) Firmware →

Snapdragon 8cx Compute Platform \(sc8180x Aa\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Compute Platform \(sc8180x Aa\) Firmware →

Snapdragon 8cx Compute Platform \(sc8180x Ab\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Compute Platform \(sc8180x Ab\) Firmware →

Snapdragon 8cx Compute Platform \(sc8180xp Ac\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Compute Platform \(sc8180xp Ac\) Firmware →

Snapdragon 8cx Compute Platform \(sc8180xp Af\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Compute Platform \(sc8180xp Af\) Firmware →

Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180x Ac\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180x Ac\) Firmware →

Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180x Af\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180x Af\) Firmware →

Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180xp Aa\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180xp Aa\) Firmware →

Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180xp Ab\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 2 5g Compute Platform \(sc8180xp Ab\) Firmware →

Snapdragon 8cx Gen 3 Compute Platform \(sc8280xp Ab\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 3 Compute Platform \(sc8280xp Ab\) Firmware →

Snapdragon 8cx Gen 3 Compute Platform \(sc8280xp Bb\) Firmware by Qualcomm

View all CVEs affecting Snapdragon 8cx Gen 3 Compute Platform \(sc8280xp Bb\) Firmware →

Video Collaboration Vc3 Platform Firmware by Qualcomm

View all CVEs affecting Video Collaboration Vc3 Platform Firmware →

Wcd9340 Firmware by Qualcomm

View all CVEs affecting Wcd9340 Firmware →

Wcd9341 Firmware by Qualcomm

View all CVEs affecting Wcd9341 Firmware →

Wcd9370 Firmware by Qualcomm

View all CVEs affecting Wcd9370 Firmware →

Wcd9375 Firmware by Qualcomm

View all CVEs affecting Wcd9375 Firmware →

Wcd9380 Firmware by Qualcomm

View all CVEs affecting Wcd9380 Firmware →

Wcd9385 Firmware by Qualcomm

View all CVEs affecting Wcd9385 Firmware →

Wsa8810 Firmware by Qualcomm

View all CVEs affecting Wsa8810 Firmware →

Wsa8815 Firmware by Qualcomm

View all CVEs affecting Wsa8815 Firmware →

Wsa8830 Firmware by Qualcomm

View all CVEs affecting Wsa8830 Firmware →

Wsa8835 Firmware by Qualcomm

View all CVEs affecting Wsa8835 Firmware →

Wsa8840 Firmware by Qualcomm

View all CVEs affecting Wsa8840 Firmware →

Wsa8845 Firmware by Qualcomm

View all CVEs affecting Wsa8845 Firmware →

Wsa8845h Firmware by Qualcomm

View all CVEs affecting Wsa8845h Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with kernel privileges leading to complete system compromise

🟠

Likely Case

System crash or denial of service through memory corruption

🟢

If Mitigated

Limited impact with proper memory protections and exploit mitigations in place

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Requires sending simultaneous requests to trigger the escape path condition

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Qualcomm August 2025 security bulletin

Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html

Restart Required: Yes

Instructions:

1. Check Qualcomm advisory for affected components. 2. Obtain updated firmware/drivers from device manufacturer. 3. Apply patches following manufacturer instructions. 4. Reboot system.

🔧 Temporary Workarounds

Disable vulnerable services

all

Identify and disable services using the vulnerable escape path if not required

Rate limiting

all

Implement rate limiting on requests to reduce simultaneous request scenarios

🧯 If You Can't Patch

Isolate affected systems from untrusted networks
Implement strict network segmentation and firewall rules

🔍 How to Verify

Check if Vulnerable:

Check Qualcomm chipset/driver versions against advisory; examine system logs for memory corruption errors

Check Version:

Device-specific commands vary; check manufacturer documentation for Qualcomm component version checking

Verify Fix Applied:

Verify updated Qualcomm driver/firmware versions match patched versions in advisory

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
Memory corruption error messages
Driver crash reports

Network Indicators:

Unusual simultaneous request patterns to affected services

SIEM Query:

Search for 'memory corruption', 'kernel panic', or Qualcomm driver crash events in system logs

📊 Metadata

CVE ID: CVE-2025-27076

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-367

EPSS Score: 0.01% exploit probability (0.9th percentile)

Published: August 6, 2025

Last Updated: August 19, 2025

🔗 References

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html Vendor Advisory