CVE-2025-27059

Use of Out-of-range Pointer Offset in TZ Firmware

Published Oct 9, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Memory corruption while performing SCM call.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Qualcomm immersive Home 214 Platform
Qualcomm immersive Home 214 Platform Firmware
Qualcomm immersive Home 216 Platform
Qualcomm immersive Home 216 Platform Firmware
Qualcomm immersive Home 316 Platform
Qualcomm immersive Home 316 Platform Firmware
Qualcomm immersive Home 318 Platform
Qualcomm immersive Home 318 Platform Firmware
Qualcomm ipq5010
Qualcomm ipq5010 Firmware
Qualcomm ipq5028
Qualcomm ipq5028 Firmware
Qualcomm qcn6023
Qualcomm qcn6023 Firmware
Qualcomm qcn6024
Qualcomm qcn6024 Firmware
Qualcomm qcn6100
Qualcomm qcn6100 Firmware
Qualcomm qcn6102
Qualcomm qcn6102 Firmware
Qualcomm qcn6112
Qualcomm qcn6112 Firmware
Qualcomm qcn6122
Qualcomm qcn6122 Firmware
Qualcomm qcn6132
Qualcomm qcn6132 Firmware
Qualcomm qcn9000
Qualcomm qcn9000 Firmware
Qualcomm qcn9001
Qualcomm qcn9001 Firmware
Qualcomm qcn9002
Qualcomm qcn9002 Firmware
Qualcomm qcn9003
Qualcomm qcn9003 Firmware
Qualcomm qcn9012
Qualcomm qcn9012 Firmware
Qualcomm qcn9022
Qualcomm qcn9022 Firmware
Qualcomm qcn9024
Qualcomm qcn9024 Firmware
Qualcomm qcn9070
Qualcomm qcn9070 Firmware
Qualcomm qcn9072
Qualcomm qcn9072 Firmware
Qualcomm qcn9074
Qualcomm qcn9074 Firmware
Qualcomm qcn9100
Qualcomm qcn9100 Firmware
Qualcomm qcn9274
Qualcomm qcn9274 Firmware
CPEs cpe:2.3:h:qualcomm:immersive_home_214_platform:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:immersive_home_216_platform:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:immersive_home_316_platform:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:immersive_home_318_platform:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:ipq5010:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:ipq5028:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6023:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6100:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6102:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6112:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6122:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn6132:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9000:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9001:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9002:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9003:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9022:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9070:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9072:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9074:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9100:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:qcn9274:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_214_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_216_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_316_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_318_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5028_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6023_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6100_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6102_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6112_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6122_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn6132_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9001_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9002_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9003_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9022_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9070_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9072_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9074_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9100_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:*
Vendors & Products Qualcomm immersive Home 214 Platform
Qualcomm immersive Home 214 Platform Firmware
Qualcomm immersive Home 216 Platform
Qualcomm immersive Home 216 Platform Firmware
Qualcomm immersive Home 316 Platform
Qualcomm immersive Home 316 Platform Firmware
Qualcomm immersive Home 318 Platform
Qualcomm immersive Home 318 Platform Firmware
Qualcomm ipq5010
Qualcomm ipq5010 Firmware
Qualcomm ipq5028
Qualcomm ipq5028 Firmware
Qualcomm qcn6023
Qualcomm qcn6023 Firmware
Qualcomm qcn6024
Qualcomm qcn6024 Firmware
Qualcomm qcn6100
Qualcomm qcn6100 Firmware
Qualcomm qcn6102
Qualcomm qcn6102 Firmware
Qualcomm qcn6112
Qualcomm qcn6112 Firmware
Qualcomm qcn6122
Qualcomm qcn6122 Firmware
Qualcomm qcn6132
Qualcomm qcn6132 Firmware
Qualcomm qcn9000
Qualcomm qcn9000 Firmware
Qualcomm qcn9001
Qualcomm qcn9001 Firmware
Qualcomm qcn9002
Qualcomm qcn9002 Firmware
Qualcomm qcn9003
Qualcomm qcn9003 Firmware
Qualcomm qcn9012
Qualcomm qcn9012 Firmware
Qualcomm qcn9022
Qualcomm qcn9022 Firmware
Qualcomm qcn9024
Qualcomm qcn9024 Firmware
Qualcomm qcn9070
Qualcomm qcn9070 Firmware
Qualcomm qcn9072
Qualcomm qcn9072 Firmware
Qualcomm qcn9074
Qualcomm qcn9074 Firmware
Qualcomm qcn9100
Qualcomm qcn9100 Firmware
Qualcomm qcn9274
Qualcomm qcn9274 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Qualcomm
Qualcomm snapdragon
Vendors & Products Qualcomm
Qualcomm snapdragon
Type Values Removed Values Added
Description Memory corruption while performing SCM call.
Title Use of Out-of-range Pointer Offset in TZ Firmware
Weaknesses CWE-823
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
qualcomm
Published
Updated
Feb 26, 2026, 5:48 PM
Reserved
Feb 18, 2025, 9:19 AM
Status
Analyzed
Published
Oct 9, 2025, 4:16 AM
Modified
Oct 8, 2026, 1:10 PM