SB2025070749 - Multiple vulnerabilities in Qualcomm chipsets
Published: July 7, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 26 secuirty vulnerabilities.
1) NULL Pointer Dereference (CVE-ID: CVE-2025-21433)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in SPS-HLOS. A local application can perform a denial of service (DoS) attack.
2) Buffer over-read (CVE-ID: CVE-2025-27057)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
3) Use After Free (CVE-ID: CVE-2025-27056)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Service. A local application can execute arbitrary code.
4) Buffer overflow (CVE-ID: CVE-2025-27043)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local application can execute arbitrary code.
5) Buffer overflow (CVE-ID: CVE-2025-27058)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Computer Vision. A local application can execute arbitrary code.
6) Buffer over-read (CVE-ID: CVE-2025-27055)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
7) Use After Free (CVE-ID: CVE-2025-27047)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local application can execute arbitrary code.
8) Double Free (CVE-ID: CVE-2025-27046)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local application can execute arbitrary code.
9) Use After Free (CVE-ID: CVE-2025-21466)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local application can execute arbitrary code.
10) Buffer over-read (CVE-ID: CVE-2025-21454)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Embedded SW. A remote attacker can perform a denial of service (DoS) attack.
11) Buffer over-read (CVE-ID: CVE-2025-21449)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Embedded SW. A remote attacker can perform a denial of service (DoS) attack.
12) Buffer over-read (CVE-ID: CVE-2025-21446)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
13) Double Free (CVE-ID: CVE-2025-21432)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in SPS-HLOS. A local application can execute arbitrary code.
14) Buffer over-read (CVE-ID: CVE-2025-21427)
The vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to improper input validation in Data HLOS - LNX. A remote attacker can read and manipulate data.
15) Cryptographic Issues (CVE-ID: CVE-2025-21422)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Automotive. A local application can read and manipulate data.
16) Improper Authentication (CVE-ID: CVE-2025-21450)
The vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to improper input validation in GPS_GNSS. A remote attacker can read and manipulate data.
17) Buffer overflow (CVE-ID: CVE-2025-21445)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data HLOS - QX. A local application can execute arbitrary code.
18) Buffer overflow (CVE-ID: CVE-2025-21444)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data HLOS - QX. A local application can execute arbitrary code.
19) Improper Validation of Array Index (CVE-ID: CVE-2024-53009)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Automotive Autonomy. A local application can read and manipulate data.
20) Buffer overflow (CVE-ID: CVE-2025-27052)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Core Services. A local application can execute arbitrary code.
21) Buffer overflow (CVE-ID: CVE-2025-21426)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Camera_Linux. A local application can read and manipulate data.
22) Double Free (CVE-ID: CVE-2025-27051)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Windows WLAN Host. A local application can execute arbitrary code.
23) Use After Free (CVE-ID: CVE-2025-27050)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
24) Out-of-bounds write (CVE-ID: CVE-2025-27044)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local application can execute arbitrary code.
25) Out-of-bounds write (CVE-ID: CVE-2025-27061)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local application can execute arbitrary code.
26) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2025-27042)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.