What is the CVSS score of CVE-2025-47342?

CVE-2025-47342 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Qualcomm Sound Platform are affected by CVE-2025-47342?

Qualcomm Bluetooth audio chips (QCC5161, QCC7225, QCC7226, QCC7228) and Qualcomm S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms are affected by a firmware use-after-free that can cause transient…

How to fix or mitigate CVE-2025-47342?

Within 24 hours, inventory all products using Qualcomm QCC5161, QCC7225, QCC7226, QCC7228 Bluetooth audio chips and Qualcomm S3, S3 Gen 2, S5, S5 Gen 2 sound platforms and confirm whether QHS is enabled with concurrent Bluetooth audio profiles; contact Qualcomm and the device OEM for advisory status and any available firmware fix, and open a risk ticket noting that no vendor-released patch is identified at time of analysis. Within 7 days, where operationally feasible, disable QHS or restrict simultaneous Bluetooth audio profiles on affected devices, limit pairing to trusted users, and monitor audio service crashes/restarts to establish exposure; test configuration changes on a representative sample before broad rollout. Within 30 days, apply the vendor firmware patch as soon as Qualcomm or the OEM releases it, revalidate QHS/multi-profile behavior after update, update the risk register and asset inventory, and maintain compensating controls until the patch is deployed.

Qualcomm Sound Platform CVE-2025-47342

HIGH

Use After Free (CWE-416)

2025-10-09 product-security@qualcomm.com

Information Disclosure Use After Free Memory Corruption Qcc7225 Firmware Qcc7226 Firmware Qcc7228 Firmware Qcc5161 Firmware S3 Gen 2 Sound Platform Firmware S3 Sound Platform Firmware S5 Gen 2 Sound Platform Firmware S5 Sound Platform Firmware

7.1

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

5.4 MEDIUM

Bluetooth audio SoC with QHS trigger implies AV:A not AV:N; a concurrency race gives AC:H; paired/connected access gives PR:L; transient DOS drives A:H with no confidentiality impact.

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:08 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.1

DescriptionCVE.org

Transient DOS may occur when multi-profile concurrency arises with QHS enabled.

AnalysisAI

Transient denial of service affects Qualcomm sound-platform firmware running on QCC5161, QCC7225, QCC7226, and QCC7228 Bluetooth audio chips as well as the S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms, but only when the QHS (Qualcomm High Speed) feature is enabled and multiple Bluetooth audio profiles are concurrently active. The root cause is a use-after-free (CWE-416) that surfaces under this specific concurrent-profile timing condition, producing a self-recovering (transient) loss of availability with a minor integrity side effect and no confidentiality impact. Exploitation requires an established, paired-level connection to the device (PR:L) and the QHS/multi-profile configuration to be in use; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), with EPSS at 0.17% (5th percentile) indicating low predicted exploitation likelihood. Note that the supplied NVD vector (AV:N/AC:L, 7.1) is more permissive than our assessed vector (AV:A/AC:H, PR:L), which reflects that the flaw is an adjacent-range, race-dependent condition rather than a reliably network-triggerable low-complexity issue.

Technical ContextAI

The defect is a memory-safety bug in Qualcomm's audio/sound-platform firmware, classified as CWE-416 (Use After Free): a heap object is released while still referenced, and the dangling pointer is later dereferenced, causing memory corruption that manifests as a transient denial of service. The triggering precondition is 'multi-profile concurrency' - several Bluetooth audio profiles (for example A2DP, HFP, LE Audio) active at the same time - combined with the Qualcomm High Speed (QHS) feature being enabled, which changes the scheduling/ownership of shared audio buffers. This is inherently a race/timing condition, so it is not deterministically reproducible on demand; our assessment therefore raises attack complexity (AC:H) and constrains the vector to the adjacent Bluetooth link (AV:A) rather than the network (AV:N) claimed in the NVD vector. The CPE data confirms the affected population is firmware images across the QCC5161/QCC7225/QCC7226/QCC7228 Bluetooth SoCs and the S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms; the device-side firmware is the vulnerable component, not an application or library, and the advisory originates from Qualcomm's product security team (product-security@qualcomm.com) via the October 2025 Qualcomm security bulletin.

RemediationAI

Apply the firmware update published in the Qualcomm October 2025 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which is the vendor-released fix for the affected QCC5161/QCC7225/QCC7226/QCC7228 and S3/S3 Gen 2/S5/S5 Gen 2 sound-platform firmware lines; because the input data does not expose an exact patched build number, obtain the specific fixed firmware revision for each chipset from Qualcomm or the OEM/licensee device vendor and validate it against the bulletin's chipset table before rollout - vendor-released patch, exact version not independently confirmed from the provided data. As a compensating control while patching is pending, disable the QHS (Qualcomm High Speed) feature in the device audio configuration where the platform permits it; this removes the triggering precondition entirely but sacrifices the high-speed audio path and may degrade throughput/latency for supported codecs. A second control is to prevent sustained multi-profile concurrency (i.e., avoid simultaneous active A2DP + HFP + LE Audio sessions) by configuration policy or by limiting concurrent profile hookup, though this constrains normal multi-profile user experience and may not be enforceable on all products. Because exploitation requires an established adjacent/pairing-level connection (PR:L), restricting device pairing to trusted peers (pairing PIN/lockdown, disabling discoverable/pairing mode when not in use, and re-pairing after firmware updates) reduces the reachable attack surface but does not eliminate the flaw for already-paired attackers. Deploy patches to end-user devices through the OEM or fleet-management channel, since these are embedded firmware images that typically cannot be updated independently of the product vendor.