Buffer Over-read in Video
Priority LOW 26CWE-126Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Information disclosure while running video usecase having rogue firmware.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00086 0th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon | QCM5430; QCM6490; QCS5430; QCS6490; QCM8550; QCS8550; QCS615; QCS9100; SM6650; SM7635; SM8650; SM8650P; SM8650Q; SM7675; SM7675P; SM8635; SM8635P; SM8750; SM8750P; SXR2330P; WCN6750; WCN6856; QCN9274; WCN7851; QCA6698AQ; WCN6650; WCN6755; WCN7850; WCN7880; WCN7860; WCN7861; WCN7881 | — | No fix listed | CNA |
- Snapdragon VendorQualcomm Affected QCM5430; QCM6490; QCS5430; QCS6490; QCM8550; QCS8550; QCS615; QCS9100; SM6650; SM7635; SM8650; SM8650P; SM8650Q; SM7675; SM7675P; SM8635; SM8635P; SM8750; SM8750P; SXR2330P; WCN6750; WCN6856; QCN9274; WCN7851; QCA6698AQ; WCN6650; WCN6755; WCN7850; WCN7880; WCN7860; WCN7861; WCN7881 Fixed in — No fix listed CNA
CPE configurations NVD · 64
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Show 54 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcs615_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcs615:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcs9100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcs9100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8650_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8650p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8650p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8750_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcn9274:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7851:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcs615_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcs615:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcs9100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcs9100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8650p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8650p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8750_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcn9274:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7851:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27033
- 2026-10-03 Alias added: GHSA-7536-9wjx-xgp5
References
More Qualcomm Qca6698aq Firmware vulnerabilities
- TI-2023-16287 Integer Overflow or Wraparound in Graphics Linux KEVCVSS 3.1HIGH 8.4
- TI-2023-16286 Use of Out-of-range Pointer Offset in Graphics KEVCVSS 3.1HIGH 8.4
- TI-2026-17287 Integer Overflow or Wraparound in Graphics KEVCVSS 3.1HIGH 7.8
- TI-2024-28736 Use After Free in DSP Service KEVCVSS 3.1HIGH 7.8
- TI-2023-16248 Use After Free in DSP Services KEVCVSS 3.1HIGH 7.8
- TI-2023-16255 Improper Authentication in Automotive OS CVSS 3.1HIGH 7.1
Sources
- CVE-2025-27033 · CVE Program
- CVE-2025-27033 · NVD
- FIRST EPSS
- GHSA-7536-9wjx-xgp5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences