Qualcomm Snapdragon Firmware
CVE-2025-47341
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Memory corruption reachable only locally via an on-device process (AV:L) with low privileges and no interaction (PR:L/UI:N), giving full C/I/A impact within an unchanged scope.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
3DescriptionCVE.org
memory corruption while processing an image encoding completion event.
AnalysisAI
Memory corruption in the image-encoding completion event handler of multiple Qualcomm chipset firmware images allows an attacker who already holds local, low-privilege code execution on the device to trigger a buffer overflow and achieve high integrity and confidentiality impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The affected platforms span FastConnect 6700/6900/7800 connectivity chips, QCC2072, QCM/QCS 5430 and 6490, SC8380XP, the VC3 video collaboration platform, WCD/WSA audio codecs, and Snapdragon 8cx Gen 3 / 7c Gen 3 compute platforms. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is negligible at 0.09% (0th percentile), consistent with a local-only precondition. Vendor-released fixes are documented in Qualcomm's October 2025 security bulletin and are distributed through device OEMs.
Technical ContextAI
The root cause is CWE-120, a classic buffer overflow arising from an unchecked copy, occurring in firmware logic that handles image-encoding completion events - the asynchronous notification path by which an image/media encoder signals that a frame or job has finished. Because these handlers are implemented in chipset firmware shared across a broad silicon family, the vulnerable code is present in the CPE-enumerated firmware images: FastConnect 6700/6900/7800 (Wi-Fi/Bluetooth combo), QCC2072, QCM5430/QCM6490 and QCS5430/QCS6490 (IoT/embedded and automotive-adjacent SoCs), SC8380XP, the Snapdragon 8cx Gen 3 and 7c Gen 3 compute platforms, and the VC3 video collaboration platform, with related WCD/WSA audio codec firmware tagged in the same advisory. The attack surface is the local media/imaging pipeline rather than a network service: per the assessed vector, the attacker must already possess low-privilege on-device code execution and be able to reach the encoding subsystem, which is normally mediated by OS drivers and framework APIs. A successful overflow can corrupt memory and yield high confidentiality and integrity impact, but the same-chipset privilege boundary (AV:L, PR:L) keeps the issue out of the unauthenticated remote-exploitation class. The breadth of affected CPE strings reflects firmware reuse across Qualcomm's portfolio rather than a set of independent vulnerabilities.
RemediationAI
Apply the fixes referenced in Qualcomm's October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) - patch availability per vendor advisory, with the exact firmware build numbers published to OEMs and surfaced through device/OS vendor updates rather than a single public version string. Because Qualcomm ships silicon firmware to device makers, most operators must track and install the corresponding OEM firmware or system update for each affected device (FastConnect 6700/6900/7800 modules, QCC2072, QCM/QCS 5430/6490, SC8380XP, VC3, Snapdragon 8cx Gen 3 / 7c Gen 3 platforms, and the tagged WCD/WSA codec firmware); a Qualcomm bulletin entry alone does not make end devices patched. Until the correct build is deployed, treat this as a local-privilege-escalation hardening problem: enforce application sandboxing and strict permissions so untrusted apps cannot invoke the image/media encoding paths (Android/iOS permission and SELinux/AppArmor policy, removal of unnecessary camera/media capabilities) - the trade-off is that legitimate camera, video and conferencing features may be degraded or blocked for restricted apps. Where the encoding subsystem is only used by first-party or signed components, restrict the media service's callable interface to those callers. Monitor advisory updates for the exact patched firmware revision per platform, and note that these controls only reduce likelihood - they do not substitute for installing the vendor firmware fix, which is the only measure that removes the overflow.
More in Fastconnect 6700 Firmware
View allQualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received
Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no
Cryptographic issue occurs due to use of insecure connection method while downloading.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today