CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability

High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-06-03. EPSS: 1% chance of exploitation in the next 30 days.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Affected products

Qualcomm AR8031 Firmware: affected versions not specified
Qualcomm CSRA6620 Firmware: affected versions not specified
Qualcomm CSRA6640 Firmware: affected versions not specified
Qualcomm Fastconnect 7800 Firmware: affected versions not specified
Qualcomm QCA2066 Firmware: affected versions not specified
Qualcomm QCA6391 Firmware: affected versions not specified
Qualcomm QCM6125 Firmware: affected versions not specified
Qualcomm QCM8550 Firmware: affected versions not specified
Qualcomm QCN9011 Firmware: affected versions not specified
Qualcomm QCN9012 Firmware: affected versions not specified
Qualcomm QCS6125 Firmware: affected versions not specified
Qualcomm QCS8550 Firmware: affected versions not specified
Qualcomm SM6475 Firmware: affected versions not specified
Qualcomm SM6650 Firmware: affected versions not specified
Qualcomm SM6650P Firmware: affected versions not specified
Qualcomm SM7435 Firmware: affected versions not specified
Qualcomm SM7635 Firmware: affected versions not specified
Qualcomm SM7635P Firmware: affected versions not specified
Qualcomm Smart Audio 400 Platform Firmware: affected versions not specified
Qualcomm Snapdragon 4 Gen 2 Mobile Platform Firmware: affected versions not specified
Qualcomm Snapdragon 680 4g Mobile Platform Firmware: affected versions not specified
Qualcomm Snapdragon 685 4g Mobile Platform (sm6225-Ad) Firmware: affected versions not specified
Qualcomm Snapdragon 6 Gen 1 Mobile Platform Firmware: affected versions not specified
Qualcomm Snapdragon w5+ Gen 1 Wearable Platform Firmware: affected versions not specified
Qualcomm SW5100 Firmware: affected versions not specified
and 19 more

Published 2025-06-03. Last modified 2026-06-17.