PT-2025-39274 · Qualcomm · Snapdragon+18

Published 2025-09-24 · Updated 2025-09-24 · CVE-2025-27036

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions versions prior to 2025

Description An information disclosure issue exists when the video engine processes input data that is smaller than the expected minimum size. This can lead to the disclosure of sensitive information. Approximately 1000 devices worldwide are estimated to be affected. The issue involves insufficient input validation within the video engine, potentially exposing underlying data structures or memory contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2025-27036

Affected Products

Snapdragon

Fastconnect 6700 Firmware

Fastconnect 6900 Firmware

Fastconnect 7800 Firmware

Qcs5430 Firmware

Qcs6490 Firmware

Sc8380Xp Firmware

Snapdragon 7C+ Gen 3 Compute Firmware

Snapdragon 8Cx Gen 3 Compute Platform (Sc8280Xp-Ab

Snapdragon 8Cx Gen 3 Compute Platform (Sc8280Xp-Bb) Firmware

Video Collaboration Vc3 Platform Firmware

Wcd9370 Firmware

Wcd9375 Firmware

Wcd9380 Firmware

Wcd9385 Firmware

Wsa8830 Firmware

Wsa8835 Firmware

Wsa8840 Firmware

Wsa8845 Firmware

References · 4

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27036 · Security Note
• https://t.me/cveNotify/136310 · Telegram Post
• https://twitter.com/CVEnew/status/1970878566175813833 · Twitter Post