Critical Qualcomm Vulnerabilities Allow Attackers to Execute Arbitrary Code Remotely

Cybersecurity

Multiple critical vulnerabilities have been identified in Qualcomm Technologies’ proprietary Data Network Stack and Multi-Mode Call Processor, allowing remote attackers to execute arbitrary code.

These vulnerabilities, designated as CVE-2025-21483 and CVE-2025-27034, each have a CVSS score of 9.8 and exploit buffer-corruption weaknesses, thereby compromising device security.

Key Takeaways

• CVE-2025-21483 and CVE-2025-27034 facilitate remote remote code execution (RCE).
• Affected platforms include Snapdragon 8 Gen1/Gen2, FastConnect, X55, and various IoT/automotive chips.
• Immediate patch application is recommended, along with filtering of RTP/PLMN traffic.

CVE-2025-21483: Remote Heap Buffer Overflow

This critical issue is located in Qualcomm’s Real-time Transport Protocol (RTP) packet reassembly within the Data Network Stack & Connectivity module.

An attacker can deploy a malicious RTP packet to trigger a heap-based buffer overflow (CWE-119), overrunning the NALU reassembly buffer.

This vulnerability, exploitable without user interaction, allows complete control over affected chipsets, including Snapdragon 8 Gen1, Snapdragon 8 Gen2, FastConnect 7800, among others. Successful exploitation results in arbitrary code execution at the kernel level, jeopardizing data confidentiality, integrity, and availability.

CVE-2025-27034: Improper Array Index Validation Flaw

CVE-2025-27034 emerges from improper validation of an array index (CWE-129) in the Multi-Mode Call Processor.

Attackers can craft a malformed Public Land Mobile Network (PLMN) selection response to corrupt memory during index parsing.

The vulnerability can be exploited over the network without privilege requirements. Affected systems include the Snapdragon X55 5G Modem-RF System, Snapdragon 8 Gen1, QCM5430, and various IoT and automotive modems. Successful exploitation leads to arbitrary code execution with elevated privileges.

Mitigations

Qualcomm has released patches for both vulnerabilities and is distributing updates to OEMs, urging immediate deployment.

Recommended actions include integrating the proprietary software updates detailed in the September 2025 Security Bulletin and ensuring the presence of hardened bounds-checking routines.

Device manufacturers must promptly apply firmware upgrades to mitigate attack vectors associated with CVE-2025-21483’s RTP parser and CVE-2025-27034’s array index logic.

Security experts advise monitoring CVSS strings and implementing network filtering as an interim security measure. Administrators should block unexpected RTP streams and PLMN selection traffic until patched firmware is applied. Additionally, implementing strict SELinux policies on Android platforms can further limit exploit possibilities.

Stakeholders are encouraged to audit firmware versions, apply patches without delay, and maintain vigilant network monitoring to defend against these severe vulnerabilities.

Qualcomm customers and end-users should contact their device manufacturers or visit Qualcomm’s support portal for detailed patch instructions and chipset coverage information.