Introduction
Remote attackers can execute code on millions of Snapdragon-powered devices without any user interaction. The vulnerability, CVE-2025-27034, is already being exploited in the wild, and it affects smartphones, IoT devices, and automotive systems worldwide.
Qualcomm dominates the mobile chipset industry. Its Snapdragon processors run in flagship phones, connected vehicles, and critical IoT infrastructure, and much of the world's mobile communications depends on its technology. A flaw in its products therefore hits consumers and enterprises hard.
Technical information
CVE-2025-27034 is a critical memory corruption vulnerability in Qualcomm's Multi-Mode Call Processor. It occurs when the processor selects a Public Land Mobile Network (PLMN) from the Steering of Roaming (SoR) failed list. The flaw is classified as CWE-129 (Improper Validation of Array Index).
The trigger is a malformed PLMN selection response from the SoR failed list. The Multi-Mode Call Processor does not validate array indices sufficiently, so processing that response allows out-of-bounds memory writes. An attacker who can send crafted PLMN selection messages to a vulnerable device can corrupt memory in the modem firmware and gain remote code execution with elevated privileges. The attack needs no user interaction or authentication, and it can be carried out remotely over network connections.
The affected code paths sit in proprietary Qualcomm modem firmware, which makes them hard for device vendors and end users to audit or monitor. The vulnerability is present in multiple generations of Snapdragon chipsets, including those in smartphones, IoT devices, and automotive systems. It is especially severe because it affects the modem processor, which operates at a lower level than the main application processor, so an exploit may bypass many traditional security controls.
No public code snippets are available for this vulnerability. The root cause is improper bounds checking when parsing PLMN selection responses, a classic memory corruption vector in low-level firmware.
Patch information
The September 2025 Android Security Bulletin identified a critical vulnerability in the System component that could allow remote code execution without user interaction. The Android Open Source Project (AOSP) patched it by adding validation checks to the affected module, so incoming data is properly sanitized. This mitigates the risk of unauthorized code execution. The patch is included in AOSP versions 15 and 16. Users should update their devices to the 2025-09-05 security patch level or later to get the fix.
Patch source: Android Security Bulletin September 2025
Detection methods
Detecting exploitation of CVE-2025-27034 takes several methods used together. (cybersixt.com)
- Analyze network traffic for unusual patterns, such as unexpected data transmissions or connections to known malicious IP addresses. Anomalies in network behavior can indicate exploitation attempts.
- Review system logs regularly for signs of unauthorized access or abnormal system behavior. Indicators may include unexpected crashes, reboots, or error messages related to memory access violations.
- Use behavioral analysis tools to detect deviations from normal device operation. Sudden changes in device performance, unexplained battery drain, or unauthorized application installations can be signs of compromise.
- Run firmware integrity checks with tools that verify device firmware. Any unauthorized modification or anomaly in the firmware can indicate exploitation of vulnerabilities like CVE-2025-27034.
- Deploy Security Information and Event Management (SIEM) systems to aggregate and analyze security data across the network. A SIEM can correlate events and identify patterns that point to exploitation attempts.
- Scan for vulnerabilities regularly to find and fix security gaps. Keeping systems updated with the latest security patches is essential to reducing the risk from known vulnerabilities.
Detection source: cybersixt.com
Affected systems and versions
Public advisories list the following affected Qualcomm products and versions:
- Snapdragon 8 Gen1
- Snapdragon X55 5G Modem-RF Systems
- QCM5430
- FastConnect 7800
- Automotive modems including Snapdragon Auto 5G
- Other IoT and infrastructure chipsets as listed in the Qualcomm September 2025 Security Bulletin
The vulnerability is present in devices running unpatched firmware prior to the 2025-09-05 security patch level. Devices running AOSP versions prior to 15 or 16 remain vulnerable, as do devices not updated to the 2025-09-05 patch level.
Vendor security history
Qualcomm has a history of critical vulnerabilities in its modem and baseband components. The same security bulletin disclosed CVE-2025-21483, which also affected core communication modules and carries a similar CVSS score. The company has improved its patch response process, with regular security bulletins and coordinated disclosures, but the recurring memory corruption bugs point to continuing problems in how it develops and tests secure firmware.
