CVE-2025-27040

Improper Input Validation in TZ Firmware

State: Published
Severity: 6.5 Medium
Published: Oct 9, 2025
Updated: Oct 9, 2025
Reserved: Feb 18, 2025

Description

Information disclosure may occur while processing the hypervisor log.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	qualcomm

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
SnapdragonQualcomm, Inc.	CSR8811Affected Immersive Home 214 PlatformAffected Immersive Home 216 PlatformAffected Immersive Home 316 PlatformAffected Immersive Home 318 PlatformAffected IPQ5010Affected IPQ5028Affected IPQ8070Affected IPQ8070AAffected IPQ8071Affected IPQ8071AAffected IPQ8072Affected IPQ8072AAffected IPQ8074Affected IPQ8074AAffected IPQ8076Affected IPQ8076AAffected IPQ8078Affected IPQ8078AAffected IPQ8173Affected IPQ8174Affected IPQ9008Affected IPQ9574Affected PMP8074Affected QCA4024Affected and 40 more versions

Product

Versions

SnapdragonQualcomm, Inc.

CSR8811Affected
Immersive Home 214 PlatformAffected
Immersive Home 216 PlatformAffected
Immersive Home 316 PlatformAffected
Immersive Home 318 PlatformAffected
IPQ5010Affected
IPQ5028Affected
IPQ8070Affected
IPQ8070AAffected
IPQ8071Affected
IPQ8071AAffected
IPQ8072Affected
IPQ8072AAffected
IPQ8074Affected
IPQ8074AAffected
IPQ8076Affected
IPQ8076AAffected
IPQ8078Affected
IPQ8078AAffected
IPQ8173Affected
IPQ8174Affected
IPQ9008Affected
IPQ9574Affected
PMP8074Affected
QCA4024Affected
and 40 more versions

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.