Qualcomm Snapdragon Firmware
CVE-2025-47323
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local IPC path reachable only from an on-device low-privilege process (AV:L/PR:L), no user interaction, integer overflow crossing user-to-root yields full CIA impact.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption while routing GPR packets between user and root when handling large data packet.
AnalysisAI
Memory corruption in Qualcomm firmware's Generic Packet Router (GPR) lets a locally present, low-privileged attacker escalate to root-level code execution on a broad range of Snapdragon, FastConnect, QAM/QCA/QCN and related chipsets. Per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw requires an existing foothold as an unprivileged local process - a malicious or compromised app, for example - which then routes an oversized data packet through the GPR path that bridges user and root/kernel contexts, triggering a CWE-190 integer overflow and full compromise of confidentiality, integrity and availability. It is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis; Qualcomm published the issue in its December 2025 security bulletin for OEM distribution.
Technical ContextAI
The Generic Packet Router (GPR) is a Qualcomm inter-processor/IPC routing service that moves framed packets between user-space clients and privileged (root/DSP/modem) contexts - the same family of transports as QMI/QRTR on Snapdragon platforms. The root cause is CWE-190, an integer overflow: when a large data packet is processed, a length or size computation wraps, producing a smaller-than-required value that is subsequently used for buffer sizing or bounds checks, so the oversized packet is written past the intended region and corrupts memory in a privileged context. Because the vulnerable code sits on the boundary between an unprivileged user context and root, successful corruption converts low-privilege local execution into kernel/root-level control. The affected surface is extremely wide, spanning CPEs for FastConnect 6900/7800 connectivity, QAM8255P/QAM8295P/QAM8620P/QAM8650P/QAM8775P/QAMSRV1H/QAMSRV1M automotive and infrastructure parts, QCA6174A and dozens of QCA/QCN Wi-Fi, WCD/WSA/WCN audio, QCM/QCS IoT and compute parts, plus numerous Snapdragon Mobile, Modem-RF (X65/X70/X72/X75), wearable, XR (AR1/AR2) and Compute (SC8280XP) platform firmware builds.
RemediationAI
Patch available per vendor advisory: Qualcomm's December 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html) documents the firmware fix, but Qualcomm ships silicon-level fixes to OEMs rather than to end users, so the actionable step for device owners and enterprises is to apply the latest OEM/carrier firmware update for every affected handset, automotive head unit, IoT module, PC and connectivity product built on the listed chipsets and to track OEM bulletins for the specific build that carries the GPR fix; no exact fixed build string is provided in the supplied data, so verify patch level against the OEM's own advisory. Until a device is updated, compensating controls should target the local, low-privilege prerequisite: enforce strict app-vetting and MDM allow-listing so untrusted code cannot run on the device, remove or sandbox unnecessary sideloaded applications, run high-value workloads (automotive, robotics, industrial) with the smallest possible set of user-installable apps, and, where the platform exposes it, restrict access to the GPR/QMI IPC character devices and handle-based services to privileged system components via SELinux/seccomp policy - with the trade-off that over-restricting these channels can break telephony, modem, sensor and audio functionality, so such policy changes must be validated per device. Because the vulnerability is not remotely triggerable, network segmentation and perimeter controls do not mitigate it; the effective defenses are prompt firmware patching plus reducing the ability of attackers to obtain the required local foothold.
More in Ar8035 Firmware
View allA Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today