Xiaomi September update: 135 security vulnerabilities fixed

As September 2025 kicks off, Xiaomi has begun distributing its latest monthly security update in line with Google’s official Android Security Bulletin. This update is notably important, as it addresses high-profile vulnerabilities impacting device security across Xiaomi’s ecosystem. The initial rollout covers flagship models like the Xiaomi 15 series, the recently launched POCO F7, and the Xiaomi 14T series. While Xiaomi continues to highlight its commitment to long-term support for premium devices, there are often variations in rollout timing across regions and models. This particular patch is critical because it resolves vulnerabilities that attackers can exploit remotely—with no user interaction required—so timely installation is highly recommended.

Key Threats Resolved in September 2025

The September 2025 Android Security Bulletin outlines two major categories of risk:

A system-level Android vulnerability that lets attackers execute remote code, potentially compromising devices without user involvement.
Several Qualcomm chipset vulnerabilities, impacting hardware-level functions in Xiaomi’s latest flagships.

CVE-2025-48539: The Zero-Interaction Exploit

This flaw allows attackers to compromise devices over Wi-Fi or Bluetooth, requiring no user action or permissions. It’s a significant risk, especially in public or enterprise environments.

Qualcomm Vulnerability Updates

Three critical Qualcomm CVEs—CVE-2025-21450, CVE-2025-21483, and CVE-2025-27034—are addressed in this release. These impact core hardware drivers, increasing the overall attack surface for affected devices.

Patch Levels: Why 2025-09-05 Matters

This month’s bulletin introduces two patch levels:

2025-09-01: Addresses the Android system-level zero-click vulnerability.
2025-09-05: Includes all system and Qualcomm hardware fixes.

Users are advised to verify their device reflects the 2025-09-05 patch for comprehensive protection.

Xiaomi’s Deployment Approach

Xiaomi has made progress in its update policy, now offering up to six years of security support for high-end devices. The September 2025 patch is closely aligned with the launch of HyperOS 3, built on Android 16. The Xiaomi 15 and Redmi K80 series are prioritized for this rollout, with POCO F7 following. Some models, such as the Xiaomi 14T, may experience a brief delay as the company balances monthly security updates and the introduction of HyperOS 3.

Recommended Actions for Users

Manually check for updates: Navigate to Settings > About Phone > System Updates.
Confirm patch level: Ensure the device reflects the 2025-09-05 patch for full coverage.
Stay informed: Follow official Xiaomi communication channels and HyperOSUpdates.com for the latest rollout details.

Given the severity of the vulnerabilities addressed, installing the September 2025 update should be a priority for all Xiaomi users.

Source: Android Security Bulletin