What is the CVSS score of CVE-2025-47340?

CVE-2025-47340 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm FastConnect 6900 are affected by CVE-2025-47340?

Qualcomm platforms using FastConnect 6900/7800 connectivity chips and the associated QCC2072, SC8380XP, WCD9378C/WCD9380/WCD9385/WSA8840/WSA8845/WSA8845H audio components are affected by a…

How to fix or mitigate CVE-2025-47340?

Within 24 hours, inventory affected assets containing FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845, or WSA8845H via OEM advisories, MDM/asset management, and procurement records, and confirm that no vendor-released patch identified at time of analysis for CVE-2025-47340. Within 7 days, engage Qualcomm and device OEMs for fix timelines and interim firmware/driver guidance, enforce application allowlisting, block sideloading or untrusted app installation on affected endpoints, review least-privilege settings, and enable EDR detection for anomalous IOCTL/driver behavior and local privilege escalation. Within 30 days, deploy OEM firmware or driver updates as soon as they are released, re-scan affected assets to verify remediation, and for high-risk unpatched devices apply isolation, privileged-access review, or replacement planning.

Qualcomm FastConnect 6900 CVE-2025-47340

HIGH

Out-of-bounds Write (CWE-787)

2025-10-09 product-security@qualcomm.com

Buffer Overflow Memory Corruption Fastconnect 6900 Firmware Fastconnect 7800 Firmware Qcc2072 Firmware Sc8380xp Firmware Wcd9378c Firmware Wcd9380 Firmware Wcd9385 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware X2000077 Firmware X2000086 Firmware X2000090 Firmware X2000092 Firmware X2000094 Firmware Xg101002 Firmware Xg101032 Firmware Xg101039 Firmware

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

IOCTL-driven memory corruption needs local code execution via a driver interface, so AV:L and PR:L; low complexity and full C/I/A impact from a controllable out-of-bounds write.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:07 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption while processing IOCTL call to get the mapping.

AnalysisAI

An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.

Technical ContextAI

The vulnerable component sits at the boundary where user-space code issues an IOCTL to firmware/driver code to obtain a memory mapping - a classic kernel/user-interface pattern in which the driver must validate the size, offset and destination of the requested mapping before copying data. CWE-787 (out-of-bounds write) is tagged alongside Buffer Overflow and Memory Corruption, indicating the handler fails to properly bound the write relative to the allocated buffer, corrupting adjacent memory. Because the issue lives in the IOCTL path, the attack surface is confined to code that can already make the appropriate device IOCTL invocation: the CVSS vector (AV:L, PR:L, UI:N) confirms a local, low-privileged caller and no user interaction, consistent with an unprivileged process escalating through a driver/firmware interface. The affected CPEs are firmware entries with no version qualifier for Qualcomm FastConnect 6900/7800, QCC2072, SC8380XP and multiple WCD/WSA audio codec parts, meaning the defect is shipped in the silicon-adjacent firmware/driver stack and must be remediated through the chipset software chain rather than by an application update alone. The specific IOCTL command code and driver interface are not disclosed in the available description.

RemediationAI

Qualcomm has published the October 2025 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) as the vendor advisory for this issue, so patch availability is per that bulletin; because the affected components are chipset firmware and drivers, fixes reach end users only through OEM/ODM firmware images, Android/device vendor security updates or downstream BSP releases, and no standalone fixed version string is published for CVE-2025-47340 in the available data. Device owners should apply the OEM firmware or monthly security update that carries the corresponding Qualcomm patch and confirm the chipset patch level (e.g. Android security patch level) rather than assuming an OS-only update covers it. Where patching is delayed, the effective compensating controls target the local, low-privilege IOCTL path: restrict installation and execution of untrusted applications that can open the affected driver interface, keep the device bootloader locked and verified boot enabled so a foothold cannot persist, and where the platform supports it use SELinux/AppArmor or seccomp policy to deny unprivileged processes access to the relevant device nodes and IOCTL operations - noting that tightening these policies can break legitimate camera, audio, connectivity or diagnostic tooling that relies on the same interface. Because the vector is purely local (AV:L) with no network-reachable path, network-level filtering does not reduce this specific risk; the priority is physical/administrative control over what code runs on the device plus timely OEM firmware updates.