CVE-2025-27038
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Published Jun 2, 2025 · updated Jun 17, 2026 · qualcomm ar8031 firmware
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Timeline
Detection, updates, and resolution for this record.
Jun 2, 2025 · Catalog
Detected
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Jun 3, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 24, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jun 24, 2025
Affected
- cpe qualcomm/ar8031 firmwareversion unspecified
- cpe qualcomm/csra6620 firmwareversion unspecified
- cpe qualcomm/csra6640 firmwareversion unspecified
- cpe qualcomm/fastconnect 7800 firmwareversion unspecified
- cpe qualcomm/qca2066 firmwareversion unspecified
- cpe qualcomm/qca6391 firmwareversion unspecified
- cpe qualcomm/qcm6125 firmwareversion unspecified
- cpe qualcomm/qcm8550 firmwareversion unspecified
- cpe qualcomm/qcn9011 firmwareversion unspecified
- cpe qualcomm/qcn9012 firmwareversion unspecified
- cpe qualcomm/qcs6125 firmwareversion unspecified
- cpe qualcomm/qcs8550 firmwareversion unspecified
- vendor Qualcomm Multiple Chipsetsversion unspecified
Sources
- CISA KEVCVE-2025-27038
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
cisa.gov - CVE.orgCVE-2025-27038
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-27038
30-day exploitation probability 1.0%
first.org - NIST NVDCVE-2025-27038
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
nvd.nist.gov