SB2025120231 - Multiple vulnerabilities in Qualcomm chipsets (November 2025)
Published: December 2, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2025-27070)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Windows Compute. A local application can execute arbitrary code.
2) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2025-27074)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in SCE-Mink. A local application can execute arbitrary code.
3) Reachable Assertion (CVE-ID: CVE-2025-47370)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in BT Controller. A remote attacker can perform a denial of service (DoS) attack.
4) Buffer over-read (CVE-ID: CVE-2025-27064)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Core Services. A local application can read and manipulate data.
5) Improper Validation of Array Index (CVE-ID: CVE-2025-47352)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
6) Exposed Dangerous Method or Function (CVE-ID: CVE-2025-47353)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Software platform based on QNX. A local application can execute arbitrary code.
7) Missing Authentication for Critical Function (CVE-ID: CVE-2025-47357)
The vulnerability allows a local application to #BASIC_IMPACT#.
The vulnerability exists due to improper input validation in SMSS. A local application can #EXT_IMPACT#.
8) Stack-based buffer overflow (CVE-ID: CVE-2025-47360)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Software platform based on QNX. A local application can execute arbitrary code.
9) Improper Validation of Array Index (CVE-ID: CVE-2025-47361)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Software platform based on QNX. A local application can execute arbitrary code.
10) Buffer over-read (CVE-ID: CVE-2025-47362)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Automotive Software platform based on QNX. A local application can read and manipulate data.
11) Integer overflow (CVE-ID: CVE-2025-47365)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Platform. A local application can execute arbitrary code.
12) Out-of-bounds write (CVE-ID: CVE-2025-47367)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WinBlast Driver. A local application can execute arbitrary code.
13) Buffer over-read (CVE-ID: CVE-2025-47368)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Service. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.