CVE-2025-27049 is a medium severity buffer over-read vulnerability (CWE-126) in various Qualcomm Snapdragon platforms and related components. It occurs during the processing of an IOCTL call for image encoding, leading to a transient denial of service (DoS) condition. The vulnerability requires low privileges and no user interaction but local access to the device. Exploitation impacts availability without compromising confidentiality or integrity. No known exploits are currently in the wild. The affected products include a broad range of Snapdragon compute platforms, FastConnect modules, and audio components widely used in mobile and embedded devices. European organizations relying on devices with these Qualcomm components may experience service disruption if exploited. Mitigation involves applying vendor patches once available and restricting access to vulnerable interfaces. Countries with high adoption of Qualcomm Snapdragon-based devices and significant mobile infrastructure, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2025-27045 is a medium severity buffer over-read vulnerability in Qualcomm Snapdragon devices affecting multiple FastConnect and other chipsets. It arises from improper handling of batch command execution in the video driver, leading to potential information disclosure. The vulnerability requires local access with low privileges and no user interaction. Exploitation could allow attackers to read sensitive memory contents, impacting confidentiality but not integrity or availability. No known exploits are currently reported in the wild. European organizations using affected Snapdragon-based devices, especially in mobile and IoT sectors, should prioritize patching once available. Mitigations include restricting local access, monitoring for unusual device behavior, and applying vendor updates promptly. Countries with high adoption of Qualcomm Snapdragon devices and strong mobile ecosystems, such as Germany, France, and the UK, are most likely to be impacted. Given the medium CVSS score and attack complexity, the threat is moderate but warrants attention due to potential data leakage risks.
CVE-2025-27041 is a medium-severity buffer over-read vulnerability (CWE-126) in Qualcomm Snapdragon chipsets affecting video packet processing. It can cause a transient denial of service (DoS) by crashing or disrupting the video firmware when processing crafted video packets. The vulnerability requires local privileges and no user interaction but has limited attack vector (local). It impacts a wide range of Snapdragon platforms including mobile, automotive, and connectivity chipsets. Although no known exploits are reported in the wild, the vulnerability could disrupt device availability temporarily. European organizations using devices with affected Snapdragon chipsets, especially in critical infrastructure or automotive sectors, may face operational disruptions. Mitigation involves applying vendor patches once available and monitoring device firmware updates closely. Countries with high adoption of Qualcomm Snapdragon devices and advanced automotive industries, such as Germany and France, are most likely to be affected. The CVSS score is 5.5, reflecting medium severity due to local access requirements and limited impact scope.
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.8, from 6.1.0 before 6.1.2.26, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.4a before 5.1.*.
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.
Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.
Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
