CVE-2025-27034

Successful exploitation can corrupt memory in the modem/baseband processing environment and may enable remote arbitrary code execution. Compromise of this component could permit execution with the privileges available to the affected communications processor, potentially undermining device communications security and enabling further compromise depending on platform isolation and vendor implementation.

Prioritize patching affected devices, especially those that cannot be readily isolated from mobile networks or operate in high-risk environments. Maintain accurate inventory of Qualcomm-based products and their modem-firmware versions, obtain security updates from OEMs and carriers, and remove or restrict unpatched devices from sensitive environments until an update is installed. There is no complete configuration-only mitigation for a vulnerability in baseband firmware.

Install the Qualcomm security updates that address CVE-2025-27034 through the applicable device, operating-system, modem-firmware, automotive, or IoT-product vendor. For Android devices, deploy the vendor update incorporating the September 2025 Android security fixes and verify that the device reports a security patch level of 2025-09-05 or later where applicable.