Quick Look: CVE-2025-59605, Qualcomm HLOS Out-of-Bounds Write Affecting 130+ Chipsets

Introduction

An out-of-bounds write in Qualcomm's HLOS component lets a local attacker with low privileges corrupt memory by supplying an oversized device identifier string. The attack can potentially escalate to full system compromise, and more than 130 chipsets are affected. CVE-2025-59605 has a CVSS 7.8 score, and Qualcomm has a documented history of similar vulnerabilities being weaponized in targeted spyware campaigns. Any organization managing a fleet of Android devices powered by Snapdragon, FastConnect, or related Qualcomm platforms should give it immediate attention.

Technical Information

Root Cause

CVE-2025-59605 is classified under CWE-787 (Out-of-Bounds Write), which MITRE ranks first among the most dangerous software weaknesses. The vulnerability is in Qualcomm's High Level Operating System (HLOS) component, in the code path that processes device identifier strings.

Under normal operation, the code parses device identifier strings into a fixed-size buffer. It does not adequately check the length of incoming identifier strings. When a string longer than the expected maximum is supplied, the write continues past the end of the allocated buffer and corrupts adjacent memory regions.

This is a classic buffer overflow in C/C++ code. CWE-787 defines the weakness as occurring when "the product writes data past the end, or before the beginning, of the intended buffer." In an operating system component like HLOS, the corrupted memory can include control data such as return addresses or function pointers, which lets an attacker redirect execution flow.

CVSS v3.1 Vector Analysis

The full CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which breaks down as follows:

Together, AC:L/PR:L/UI:N mean that once an attacker has any local code execution on the device, the barrier to triggering this vulnerability is very low. The attack needs no special timing, race conditions, or user interaction.

Attack Flow

Based on the vulnerability classification and the characteristics of CWE-787, exploitation follows this sequence:

1. The attacker gets code execution on the target device at a low privilege level. This could come from a malicious application the user installed, a supply-chain compromise, or a multi-stage exploitation chain in which a remote code execution vulnerability provides the initial foothold.

2. The attacker builds a device identifier string longer than the maximum length the HLOS processing routine expects.

3. The attacker passes the crafted string to HLOS for processing. HLOS copies the oversized string into a buffer sized for the expected maximum length without proper bounds checking, and the write overflows past the buffer boundary.

4. The overflow corrupts adjacent memory. Depending on the memory layout, it can overwrite function pointers, return addresses, or other control-flow data structures.

5. HLOS runs at a higher privilege level than the attacking process, so a successful control-flow hijack lets the attacker escalate from a low-privilege local account to full system compromise, with high impact on confidentiality, integrity, and availability.

Companion Vulnerabilities in the Same Bulletin

The Qualcomm June 2026 Security Bulletin also covers several other vulnerabilities, including more CWE-787 flaws in other components:

CWE-787 turns up in HLOS, DSP Services, and other components within a single bulletin. That recurrence points to a systemic bounds-checking problem in Qualcomm's proprietary C/C++ codebase rather than an isolated defect.

Patch Information

The fix for CVE-2025-59605 ships through the coordinated Qualcomm and Android security update pipeline. The vulnerability is in a Qualcomm closed-source component, so no public source code diff is available to review.

Qualcomm discovered the vulnerability internally and notified OEM customers on 2025-12-01, about six months before public disclosure on June 1, 2026. During that window, Qualcomm shared the binary patch directly with its partners so they could integrate it into their firmware builds.

On the Android side, the Android Security Bulletin for June 2026 lists CVE-2025-59605 in its "Qualcomm closed-source components" section under Android bug ID A-465462444. The ID is marked with an asterisk, which means the fix is not publicly accessible through AOSP. The 2026-06-05 security patch level covers the fix.

How to verify you are protected: Check that your device's security patch level is 2026-06-05 or later. On Android devices, open Settings, then About Phone, then Android Security Patch Level.

The patch travels from Qualcomm to OEMs to end-user devices through the standard Android monthly security update process. Updated binary drivers for Pixel devices are published on the Google Developer site. Other manufacturers (Samsung, Xiaomi, OnePlus, and others) deliver the fix through their own monthly security update channels.

The affected chipsets span over 130 Qualcomm products, including the Snapdragon 8 Gen 1 and Gen 2, the Snapdragon 888/865/870 families, FastConnect 6200/6700/6800/6900/7800 Wi-Fi and Bluetooth controllers, automotive platforms (SA8155P, SA8295P, SA9000P), and various QCA series networking chipsets. The Qualcomm bulletin states that "the list of affected chipsets may not be complete" and tells device OEMs to contact Qualcomm for a definitive status.

No workarounds are available. Remediation depends entirely on OEM patch deployment.

Affected Systems and Versions

The vulnerability affects Qualcomm's HLOS component across a broad range of chipset families. The Qualcomm June 2026 Security Bulletin lists over 130 affected products and warns that the list may not be complete. Known affected chipset families include:

FastConnect Series

• FastConnect 6200
• FastConnect 6700
• FastConnect 6800
• FastConnect 6900
• FastConnect 7800

Snapdragon Mobile Platforms

• Snapdragon 8 Gen 1
• Snapdragon 8 Gen 2
• Snapdragon 888
• Snapdragon 865
• Snapdragon 870
• Multiple additional Snapdragon mobile platforms across tiers

Snapdragon Compute Platforms

• Multiple laptop and desktop platforms

Automotive Platforms

• SA8155P
• SA8295P
• SA9000P

Networking and Audio

• Various QCA series networking chipsets
• Various audio and WSA subsystem components

Treat any Android device on an affected chipset with a security patch level earlier than 2026-06-05 as vulnerable.

Vendor Security History

Qualcomm's proprietary firmware has a recurring history of memory corruption vulnerabilities, and several were confirmed as exploited in the wild before patches reached end users.

CVE-2024-43047 was a use-after-free vulnerability in the DSP service that Qualcomm acknowledged "may have been under limited, targeted exploitation." It was weaponized in spyware attacks against journalists and dissidents, with links to commercial surveillance vendors.

CVE-2026-21385 was an integer overflow in the graphics subcomponent that led to memory corruption and affected 235 chipsets. Google confirmed it was exploited in targeted Android attacks. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2026, and required federal agencies to patch by March 24, 2026.

Google and Qualcomm consistently describe these exploited vulnerabilities as "limited, targeted." That phrasing indicates exploitation by sophisticated actors, typically nation-state groups or commercial spyware vendors, against high-value targets.

The June 2026 bulletin that contains CVE-2025-59605 also lists several other CWE-787 vulnerabilities in different Qualcomm components. That reinforces the case that insufficient bounds checking is still a systemic problem in the company's large embedded C/C++ codebase. Qualcomm's disclosure process is systematic and well structured, but the underlying code keeps producing memory-safety vulnerabilities at a notable rate.

Patch fragmentation is inherent in Qualcomm's ecosystem, and it is the main operational concern. Qualcomm does not deliver patches directly to end users. The OEM-mediated patch pipeline introduces variable delays: some manufacturers patch within weeks, and others never deploy updates for older device models. This fragmentation is the single largest operational risk in responding to Qualcomm chipset vulnerabilities.

References

• NVD: CVE-2025-59605
• Qualcomm June 2026 Security Bulletin
• Android Security Bulletin: June 2026
• Android Security Bulletin: June 2026 (XR)
• Qualcomm Product Security
• CWE-787: Out-of-Bounds Write
• CISA Known Exploited Vulnerabilities Catalog
• CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Attacks
• High-Severity Zero-Day Vulnerability in Qualcomm Chips Actively Exploited
• Android Security Bulletin: March 2026
• Smartphone SoC Market Research Report