CVE-2025-27046: Qualcomm Aqt1000 Use-After-Free Flaw

CVE-2025-27046 Overview

CVE-2025-27046 is a memory corruption vulnerability affecting a broad range of Qualcomm firmware components, including FastConnect connectivity chipsets, WCD/WSA audio codecs, and Snapdragon compute platforms. The flaw is triggered when multiple simultaneous escape calls are processed, leading to a double free condition [CWE-415]. A local attacker with low privileges can exploit the race between concurrent calls to corrupt kernel or driver memory. Successful exploitation impacts confidentiality, integrity, and availability on the affected device. Qualcomm addressed the issue in the July 2025 security bulletin covering dozens of chipset firmware packages used in mobile, compute, and IoT products.

Critical Impact
Local, low-privileged attackers can trigger memory corruption in Qualcomm firmware to achieve arbitrary code execution or crash the affected device.

Affected Products

Qualcomm FastConnect 6200, 6700, 6800, 6900, and 7800 firmware
Qualcomm WCD9340/9341/9370/9375/9380/9385 and WSA8810–WSA8845H audio codec firmware
Qualcomm QCM/QCS 5430/6490, SC7180, SC8180X, SC8280XP, SC8380XP, SM6250, and Video Collaboration VC3 platform firmware

Discovery Timeline

2025-07-08 - CVE-2025-27046 published to NVD
July 2025 - Qualcomm releases fix in the Qualcomm Security Bulletin July 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27046

Vulnerability Analysis

The vulnerability is a double free condition [CWE-415] that occurs when multiple escape calls are processed simultaneously in Qualcomm driver code. Escape calls are typically vendor-defined ioctl-style entry points used by graphics, audio, and connectivity drivers to pass control data between user space and firmware or kernel components. When two or more escape calls execute concurrently against shared state, the same memory allocation can be released more than once. This corrupts heap metadata and can be manipulated to overwrite adjacent structures.

Root Cause

The root cause is missing or insufficient synchronization around allocation lifecycle management inside the escape call handler. Without proper locking or reference counting, one thread frees a buffer while another thread continues to hold and release the same pointer. The resulting double free undermines heap integrity in the affected firmware and driver components.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker running an unprivileged application on the device can issue concurrent escape calls from multiple threads to race the handler. Successful races corrupt firmware memory and can be leveraged for privilege escalation, code execution in a privileged context, or denial of service. Qualcomm has not confirmed exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept exploit code has been published. See the Qualcomm Security Bulletin July 2025 for vendor-provided technical details.

Detection Methods for CVE-2025-27046

Indicators of Compromise

Unexpected kernel panics, driver crashes, or watchdog resets referencing FastConnect, WCD, WSA, or Adreno driver stacks
Repeated SIGSEGV or SIGBUS events from unprivileged processes issuing ioctl or escape calls to Qualcomm device nodes
Kernel log entries indicating heap corruption, double free, or slab poisoning in Qualcomm vendor modules

Detection Strategies

Monitor kernel and dmesg output on affected devices for abnormal termination of Qualcomm driver threads and heap consistency errors
Baseline the frequency of escape or ioctl calls per process and alert on unprivileged processes generating high-volume concurrent calls
Correlate device reboots and firmware reload events with the process context that preceded the fault

Monitoring Recommendations

Ingest mobile device management (MDM) telemetry and OEM crash logs into a central data lake to surface repeated firmware faults across the fleet
Track firmware and security patch level (SPL) values across managed endpoints to identify devices still running vulnerable pre-July 2025 builds
Alert on installation of unsigned or side-loaded applications on devices with unpatched Qualcomm firmware

How to Mitigate CVE-2025-27046

Immediate Actions Required

Apply the July 2025 Qualcomm security patch level (SPL) or later on all affected devices as delivered by the device OEM
Inventory endpoints containing FastConnect, WCD, WSA, QCM/QCS, or SC-series firmware and prioritize patch deployment for high-value or exposed devices
Restrict installation of untrusted applications that could invoke driver escape calls, particularly on shared or kiosk devices

Patch Information

Qualcomm published fixes for CVE-2025-27046 in the Qualcomm Security Bulletin July 2025. Device manufacturers must integrate the updated firmware into their monthly security updates. Verify remediation by confirming the device reports a security patch level of July 2025 or later.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Reduce attack surface by enforcing application allowlisting and blocking installation of unknown APKs or binaries on managed devices
Isolate unpatched IoT and video collaboration platforms on segmented networks until firmware updates are available from the OEM

bash

# Verify Android security patch level on affected devices
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-07-01 or later