⚠ Actively exploited
Added to CISA KEV on 2025-06-03. Federal agencies required to patch by 2025-06-24. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-27038 — Use After Free in INC Snapdragon

CWE-416 — Use After FreeCWE-476 — NULL Pointer Dereference10 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.4%
top 19.76%
CISA KEV
KEV
Added 2025-06-03
Due 2025-06-24
Exploit
No known exploits
Affected products
6
Qualcomm INC SnapdragonGoogle AndroidMsrc Azl3 Hyperv-daemons 6.6.22.1-2 ON Azure Linux 3.0+3 more
Timeline
PublishedJun 3
KEV addedJun 3
KEV dueJun 24
Latest updateMar 5
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5qualcomm_inc/snapdragon44 versions+43

🔴Vulnerability Details

2
GHSA
GHSA-h454-pc9h-rvh2: Memory corruption while rendering graphics using Adreno GPU drivers in Chrome↗2025-06-03
▶
VulnCheck
Qualcomm Multiple Chipsets Use-After-Free Vulnerability↗2025
▶

📋Vendor Advisories

3
Android
CVE-2025-27038: Display↗2025-08-01
▶
CISA
Qualcomm Multiple Chipsets Use-After-Free Vulnerability↗2025-06-03
▶
Microsoft
clk: Fix clk_core_get NULL dereference↗2024-05-14
▶

🕵️Threat Intelligence

4
Mandiant
Look What You Made Us Patch: 2025 Zero-Days in Review↗2026-03-05
▶
Mandiant
Look What You Made Us Patch: 2025 Zero-Days in Review↗2026-03-05
▶
Bleepingcomputer
Android gets patches for Qualcomm flaws exploited in attacks↗2025-08-05
▶
Bleepingcomputer
Qualcomm fixes three Adreno GPU zero-days exploited in attacks↗2025-06-02
▶