CVE-2025-27077: Qualcomm Qam8255p Use-After-Free Flaw

CVE-2025-27077 Overview

CVE-2025-27077 is a memory corruption vulnerability affecting a broad range of Qualcomm automotive and connectivity firmware platforms. The flaw occurs while processing messages inside a guest virtual machine (VM) and is classified as a Use-After-Free issue [CWE-416]. A local, low-privileged attacker operating inside a guest VM can trigger the condition to corrupt memory in the host or hypervisor context. Successful exploitation compromises the confidentiality, integrity, and availability of the affected system. Qualcomm disclosed the issue in its September 2025 Security Bulletin, which covers a large set of automotive System-on-Chip (SoC) and connectivity components spanning the SA, QAM, QCA, and SRV product families.

Critical Impact
A guest VM process can corrupt memory during message handling, enabling local code execution or privilege escalation across the virtualization boundary on affected Qualcomm platforms.

Affected Products

Qualcomm Snapdragon Auto platforms including SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P, SA7255P, and SA7775P firmware
Qualcomm QAM automotive modules including QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, and QAMSRV1M firmware
Qualcomm QCA connectivity chipsets (QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ) and SRV1H, SRV1L, SRV1M firmware

Discovery Timeline

2025-09-24 - CVE-2025-27077 published to the National Vulnerability Database (NVD)
2025-09 - Qualcomm publishes the Qualcomm Security Bulletin September 2025 documenting the issue
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-27077

Vulnerability Analysis

The vulnerability resides in the message processing path used by a guest VM on affected Qualcomm platforms. The underlying weakness is a Use-After-Free (UAF) condition [CWE-416], meaning code continues to reference memory that has already been released back to the allocator. When a guest issues or handles a specifically shaped message, the stale pointer is dereferenced and the freed object can be reallocated with attacker-influenced data.

Because the attack originates inside a guest VM but corrupts memory in a shared or higher-privileged component, exploitation crosses an isolation boundary that is critical to automotive and hypervisor deployments. On automotive SoCs like SA8295P and SA8775P, this boundary typically separates untrusted infotainment or telematics workloads from safety-relevant domains.

Root Cause

The root cause is improper lifetime management of a message object in the guest VM handling code. A reference to an allocated structure is retained after the object is freed, allowing subsequent access to operate on reclaimed memory. Because message processing runs with elevated privileges relative to the guest, corruption of the freed slot directly influences control data used by the host component.

Attack Vector

Exploitation requires local access with low privileges inside a guest VM, and no user interaction. An attacker running code in a guest VM crafts a sequence of messages that triggers the free of a target object followed by an access through the stale pointer. By racing an allocation into the freed slot with attacker-controlled contents, the adversary can achieve arbitrary write primitives that lead to code execution in the message-processing context.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities (KEV) listing exists for CVE-2025-27077 at the time of publication. Qualcomm's advisory contains the authoritative technical description; see the Qualcomm Security Bulletin September 2025 for component-level details.

Detection Methods for CVE-2025-27077

Indicators of Compromise

Unexpected crashes, reboots, or watchdog resets of virtualization or hypervisor services on affected Qualcomm SoCs
Anomalous kernel or firmware log entries referencing message-processing faults inside guest VMs
Guest VM processes generating abnormally high volumes of inter-VM or host messages that do not match baseline workloads

Detection Strategies

Compare installed firmware build identifiers on affected devices against the fixed versions listed in the Qualcomm September 2025 bulletin
Enable hypervisor and guest crash telemetry and forward it to a centralized log store for correlation on repeated faults in the same component
Monitor for guest VM behavior that deviates from documented interfaces, particularly repeated malformed message submissions preceding a host fault

Monitoring Recommendations

Continuously inventory automotive and IoT assets that embed the listed SA, QAM, QCA, or SRV components
Track vendor firmware updates and validate that over-the-air (OTA) or supplier-delivered patches are applied to every affected unit
Alert on repeated guest VM restarts or hypervisor exceptions, which may indicate exploitation attempts against the message-processing path

How to Mitigate CVE-2025-27077

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm September 2025 Security Bulletin to every affected SoC in the fleet
Coordinate with OEMs and Tier 1 suppliers to schedule OTA updates for vehicles and connected devices using the listed automotive platforms
Restrict which workloads are permitted to execute in guest VMs on affected hardware until patches are deployed

Patch Information

Qualcomm has published fixes for CVE-2025-27077 as part of its September 2025 Security Bulletin. Device manufacturers must integrate the updated firmware and deliver it to end devices through their standard update channels. Refer to the Qualcomm Security Bulletin September 2025 for the exact affected component versions and patch identifiers.

Workarounds

Reduce the attack surface by disabling or removing untrusted guest VM workloads on affected hardware where feasible
Enforce strict validation of any user-supplied data forwarded into guest VM message channels
Segment automotive networks so that infotainment or telematics domains cannot reach safety-critical buses without inspection

bash

# Verify firmware build on an affected Qualcomm-based device (example)
# Replace with vendor-supplied tooling for your specific platform
getprop ro.boot.qcom.baseband
getprop ro.build.version.incremental
# Compare output against fixed builds listed in the
# Qualcomm September 2025 Security Bulletin before returning the unit to service