Qualcomm Security Bulletin: Multiple CVEs for Memory Corruption and Info Disclosure

From this web page screenshot, the following key information about vulnerabilities can be extracted: Overview Release Date: 11/03/2025 Purpose of Announcement: To assist Qualcomm Technologies, Inc. (QTI) customers in integrating security updates into already released or upcoming devices. Summary of Contents Announcement Content: No special announcement at this time. Acknowledgments Acknowledged Researchers: The table lists multiple researchers who reported these security issues, including several from Xiaomi and Shadow Boundary Security Lab, as well as Zino Han from Ambers Elephant Security Lab. Private Software Issues Overview: A list of security vulnerabilities in private software, including details of various severity levels, CVSS scores, technical domains, and report dates. Open Source Software Issues Overview: A list of related security issues in open source software, including details, severity levels, CVSS scores, and technical impact areas. Industry Coordination Overview: Mentions coordination activities with industry security standards and organizations. Vulnerability Details Summary CVE-2025-27070 Description: Memory corruption in Windows computing caused by write operation overflow. Severity: High CVSS: 7.8 Affected Chips: Numerous Qualcomm/Qualcomm chips and platforms CVE-2025-27074 Description: Memory corruption caused by incorrect cache size calculation when processing GP command responses in SCE-Mink. Severity: High CVSS: 8.8 Affected Chips: Various chip models listed CVE-2025-47352 Description: Buffer overflow in audio stream processing leading to memory corruption. Severity: High CVSS: 7.8 CVE-2025-47353 Description: Memory corruption caused by exposure of dangerous methods during request handling on QNX-based automation platforms. Severity: High CVSS: 7.8 CVE-2025-47357 Description: Information disclosure in SMSS user-level driver due to missing critical validation during QFPROM read/write operations. Severity: High CVSS: 8.0 CVE-2025-47360 Description: Heap-based buffer overflow in client message processing leading to memory corruption. Severity: High CVSS: 7.8 CVE-2025-47362 Description: Information disclosure caused by processing registration commands from clients with invalid payloads. Severity: Medium CVSS: 6.1 CVE-2025-47365 Description: Memory corruption caused by integer overflow when handling large data. Severity: High CVSS: 7.8 CVE-2025-47367 Description: Memory corruption potentially triggered when upper-layer core interacts with LPD access. Severity: High CVSS: 7.8 CVE-2025-47368 Description: Memory corruption caused by illegal reference during user buffer handling. Severity: High CVSS: 7.8 CVE-2025-47370 Description: Temporary performance issue caused by illegal connection requests from remote devices. Severity: Medium CVSS: 6.5 CVE-2025-27064 Description: Information disclosure during registration command processing in storage system. Data leakage occurs when client sends commands with invalid dig part. Severity: Medium CVSS: 6.1

Goal Reached Thanks to every supporter — we hit 100%!

Qualcomm Security Bulletin: Multiple CVEs for Memory Corruption and Info Disclosure