CVE-2025-47342 is a high-severity use-after-free vulnerability (CWE-416) affecting multiple Qualcomm Snapdragon audio platforms, including QCC5161, QCC7225, QCC7226, QCC7228, and various S3 and S5 Sound Platforms. The flaw arises when multi-profile concurrency is enabled with Qualcomm High-Speed (QHS) mode active, potentially causing a transient denial-of-service (DoS) condition. Exploitation requires network-level access with low privileges but no user interaction, and it can result in loss of availability due to improper memory handling. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using affected Snapdragon audio chipsets in their devices may experience service interruptions or degraded audio functionality. Mitigation involves closely monitoring vendor advisories for patches, limiting network exposure of affected devices, and disabling multi-profile concurrency or QHS mode where feasible. Countries with significant consumer electronics manufacturing and high adoption of Qualcomm Snapdragon-based devices, such as Germany, France, and the UK, are most likely to be impacted. Given the potential for denial-of-service and ease of exploitation, this vulnerability is rated as high severity and requires prompt attention from security teams managing affected hardware.
CVE-2025-27049 is a medium severity buffer over-read vulnerability (CWE-126) in various Qualcomm Snapdragon platforms and related components. It occurs during the processing of an IOCTL call for image encoding, leading to a transient denial of service (DoS) condition. The vulnerability requires low privileges and no user interaction but local access to the device. Exploitation impacts availability without compromising confidentiality or integrity. No known exploits are currently in the wild. The affected products include a broad range of Snapdragon compute platforms, FastConnect modules, and audio components widely used in mobile and embedded devices. European organizations relying on devices with these Qualcomm components may experience service disruption if exploited. Mitigation involves applying vendor patches once available and restricting access to vulnerable interfaces. Countries with high adoption of Qualcomm Snapdragon-based devices and significant mobile infrastructure, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2025-27045 is a medium severity buffer over-read vulnerability in Qualcomm Snapdragon devices affecting multiple FastConnect and other chipsets. It arises from improper handling of batch command execution in the video driver, leading to potential information disclosure. The vulnerability requires local access with low privileges and no user interaction. Exploitation could allow attackers to read sensitive memory contents, impacting confidentiality but not integrity or availability. No known exploits are currently reported in the wild. European organizations using affected Snapdragon-based devices, especially in mobile and IoT sectors, should prioritize patching once available. Mitigations include restricting local access, monitoring for unusual device behavior, and applying vendor updates promptly. Countries with high adoption of Qualcomm Snapdragon devices and strong mobile ecosystems, such as Germany, France, and the UK, are most likely to be impacted. Given the medium CVSS score and attack complexity, the threat is moderate but warrants attention due to potential data leakage risks.
CVE-2025-27041 is a medium-severity buffer over-read vulnerability (CWE-126) in Qualcomm Snapdragon chipsets affecting video packet processing. It can cause a transient denial of service (DoS) by crashing or disrupting the video firmware when processing crafted video packets. The vulnerability requires local privileges and no user interaction but has limited attack vector (local). It impacts a wide range of Snapdragon platforms including mobile, automotive, and connectivity chipsets. Although no known exploits are reported in the wild, the vulnerability could disrupt device availability temporarily. European organizations using devices with affected Snapdragon chipsets, especially in critical infrastructure or automotive sectors, may face operational disruptions. Mitigation involves applying vendor patches once available and monitoring device firmware updates closely. Countries with high adoption of Qualcomm Snapdragon devices and advanced automotive industries, such as Germany and France, are most likely to be affected. The CVSS score is 5.5, reflecting medium severity due to local access requirements and limited impact scope.
CVE-2025-27040 is a medium severity vulnerability in Qualcomm Snapdragon platforms caused by improper input validation during hypervisor log processing. It can lead to information disclosure without requiring user interaction but does require low-level privileges. The flaw affects a wide range of Qualcomm Snapdragon chipsets used in embedded and IoT devices. Exploitation could allow attackers to access sensitive information from the hypervisor logs, potentially compromising confidentiality. No known exploits are currently in the wild, and no patches have been published yet. European organizations using affected devices, especially in telecom, IoT, and networking sectors, should be vigilant. Mitigation involves monitoring vendor updates, restricting access to vulnerable components, and applying strict input validation controls where possible. Countries with strong telecom infrastructure and high adoption of Qualcomm chipsets, such as Germany, France, and the UK, are most likely to be impacted.
