CVE-2025-27038
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 June 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.02% probability · 61th percentile
- CISA KEV
- Listed 3 June 2025 · due 24 June 2025
- Weakness
- CWE-416
- Affected
- qualcomm/ar8031 firmware · qualcomm/csra6620 firmware · qualcomm/csra6640 firmware · qualcomm/fastconnect 7800 firmware · qualcomm/qca2066 firmware · qualcomm/qca6391 firmware · qualcomm/qcm6125 firmware · qualcomm/qcm8550 firmware · qualcomm/qcn9011 firmware · qualcomm/qcn9012 firmware · qualcomm/qcs6125 firmware · qualcomm/qcs8550 firmware · qualcomm/video collaboration vc1 platform firmware · qualcomm/sm6475 firmware · qualcomm/sm6650 firmware · qualcomm/sm6650p firmware · qualcomm/sm7435 firmware · qualcomm/sm7635 firmware · qualcomm/sm7635p firmware · qualcomm/smart audio 400 platform firmware · +24 more
- Source
- product-security@qualcomm.com
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-27038
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.