CVE-2025-27075: Qualcomm Aqt1000 Buffer Overflow Flaw

CVE-2025-27075 Overview

CVE-2025-27075 is a memory corruption vulnerability in the Bluetooth Host component of numerous Qualcomm chipsets and firmware platforms. The flaw occurs when the Bluetooth Host processes an IOCTL (Input/Output Control) command containing a larger-than-expected buffer. The weakness is classified as [CWE-129] Improper Validation of Array Index. A local attacker with low privileges can trigger the corruption without user interaction to compromise confidentiality, integrity, and availability on the affected device.

Critical Impact
Local, low-privileged code can trigger memory corruption in the Bluetooth Host on affected Qualcomm platforms, enabling potential privilege escalation and full compromise of the impacted device.

Affected Products

Qualcomm FastConnect 6200, 6700, 6800, 6900, and 7800 firmware
Qualcomm Snapdragon 7c+ Gen 3, 8c, 8cx, 8cx Gen 2 5G, and 8cx Gen 3 Compute platforms
Qualcomm QCA6391/6420/6430, QCM5430/6490, QCS5430/6490, AQT1000, SC8380XP, WCD93xx, and WSA88xx series firmware

Discovery Timeline

2025-08-06 - CVE-2025-27075 published to NVD
August 2025 - Qualcomm publishes advisory in the August 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27075

Vulnerability Analysis

The vulnerability lives in the Bluetooth Host stack on Qualcomm platforms. When user-space software issues an IOCTL command to the Bluetooth driver interface, the handler fails to properly validate an array index or size constraint against the supplied buffer length. Supplying a buffer larger than the handler expects causes out-of-bounds memory access and structural corruption of kernel-adjacent data.

Because the attack vector is local and requires only low privileges, any process able to communicate with the Bluetooth Host IOCTL interface can reach the vulnerable code path. Successful exploitation impacts confidentiality, integrity, and availability, and can be used as a stepping stone from an unprivileged application to kernel or system-level code execution.

Root Cause

The root cause is improper validation of an array index (CWE-129) during IOCTL processing in the Bluetooth Host. The handler trusts a length or index value associated with the caller-supplied buffer and does not enforce the bounds of the destination structure. A larger buffer therefore drives writes or reads beyond the intended memory region.

Attack Vector

An attacker requires local access and low privileges on the target device, such as a compromised application on a Snapdragon-based endpoint or compute platform. The attacker opens the Bluetooth Host device interface and issues a crafted IOCTL with an oversized buffer, driving the driver into a memory corruption state. No user interaction is required, and the scope remains unchanged, meaning corruption is contained within the vulnerable component's security context but can still yield privilege escalation.

No verified public proof-of-concept or exploit code is available for CVE-2025-27075 at the time of writing. Refer to the Qualcomm August 2025 Security Bulletin for authoritative technical detail.

Detection Methods for CVE-2025-27075

Indicators of Compromise

Unexpected crashes, panics, or watchdog resets in the Bluetooth Host process or driver on Qualcomm-based devices.
Kernel or driver log entries showing abnormal IOCTL sizes, buffer length mismatches, or memory faults tied to the Bluetooth subsystem.
Unprivileged processes repeatedly opening Bluetooth device nodes and issuing large or malformed IOCTL requests.

Detection Strategies

Monitor endpoint telemetry for repeated Bluetooth driver faults or restarts on Snapdragon compute platforms and mobile devices.
Correlate process execution events with access to Bluetooth Host device interfaces, especially from applications that do not normally use Bluetooth APIs.
Alert on privilege escalation patterns that follow Bluetooth subsystem crashes, such as new root or system-context processes spawned by previously unprivileged callers.

Monitoring Recommendations

Ingest device kernel and Bluetooth stack logs into a centralized analytics platform to baseline normal IOCTL behavior.
Track firmware and OEM patch levels on managed endpoints to detect devices still exposed to the August 2025 Qualcomm bulletin fixes.
Enable behavioral monitoring for post-exploitation activity such as unexpected privilege changes, driver loads, or persistence mechanisms following Bluetooth anomalies.

How to Mitigate CVE-2025-27075

Immediate Actions Required

Inventory all endpoints, mobile devices, and compute platforms using the affected Qualcomm chipsets and firmware families listed in the advisory.
Apply OEM firmware updates that incorporate the Qualcomm August 2025 patches as soon as vendor images are available for each platform.
Restrict local access to affected devices by enforcing least-privilege application policies and removing untrusted software.

Patch Information

Qualcomm addressed the flaw in the Qualcomm August 2025 Security Bulletin. Because Qualcomm chipsets are integrated by OEMs, patches reach end-user devices through downstream firmware and OS updates. Coordinate with device manufacturers and mobile carriers to confirm that fixed firmware has been deployed on affected FastConnect, Snapdragon Compute, QCA, QCM, QCS, WCD, and WSA product lines.

Workarounds

Where feasible, disable the Bluetooth radio and Host stack on devices that do not require Bluetooth connectivity until firmware updates are applied.
Enforce application allow-listing to limit which local processes can open Bluetooth device nodes and issue IOCTL commands.
Isolate devices that cannot yet receive vendor patches by placing them into restricted network and management zones.

bash

# Configuration example: disable Bluetooth service on Linux-based Snapdragon compute devices
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo rfkill block bluetooth