Qualcomm Chipset Firmware CVE-2025-47347
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Control commands to the VM interface require local privileged code (AV:L, PR:L), the overflow is reliably triggerable (AC:L), and memory-corruption code execution yields full C/I/A impact in the same component (S:U).
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Memory corruption while processing control commands in the virtual memory management interface.
AnalysisAI
Memory corruption in the virtual memory management interface of Qualcomm chipset firmware lets a locally privileged attacker overwrite stack memory by sending malformed control commands, potentially escalating privileges or executing code within the affected platform's firmware context (CVSS 7.8, CWE-121). The attack surface is local only - per the assessed vector (AV:L/PR:L/UI:N) an attacker must already have a low-privileged foothold on the device and the ability to issue control commands to that internal interface, which limits reach given the affected products are embedded automotive, server and connectivity platforms rather than general-purpose remote services. EPSS is 0.09%, no public exploit code was identified, and there is no CISA KEV entry, so this is a genuine but not emergency-priority local vulnerability that should be handled through routine vendor firmware update cycles.
Technical ContextAI
The root cause class is CWE-121, a stack-based buffer overflow, occurring in the code path that parses control commands for the virtual memory management interface. Firmware that manages virtual memory mappings in these Qualcomm SoCs copies attacker-influenced command payloads without adequate length validation into a fixed-size stack buffer, corrupting adjacent stack memory and giving the caller control over saved state such as return addresses or frame pointers. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High), meaning the attack is local, low complexity, requires low privileges and no user interaction, and - because scope is unchanged (S:U) - the resulting confidentiality, integrity and availability impact is confined to the security context of the vulnerable firmware component rather than crossing a full privilege boundary by default. CPE data enumerates the affected firmware images across Qualcomm's automotive (SA-series), telematics/connectivity (QAM and QCA-series) and server (SRV/QAMSRV) product lines, all recorded with wildcard versions, which indicates the vulnerability is a firmware-generation issue affecting the vendor's reference firmware rather than a single tagged release.
RemediationAI
No exact fixed firmware version number was present in the available data, so remediation must be driven by the vendor advisory: consult the Qualcomm October 2025 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html) and apply the patched firmware image it identifies for each affected QAM, QCA, SA and SRV chipset, coordinating with the OEM or device vendor since Qualcomm supplies the reference firmware but the update is delivered through downstream device/board vendors. Until a patched image is installed, compensating controls should focus on the local-only, low-privilege prerequisite: tighten the privileges of local processes and applications that can reach the virtual memory management interface, and disable or de-register any debug, engineering or test services that expose control-command paths to that interface (side effect: loss of diagnostic capability used for bring-up and field debugging). Apply mandatory access control (e.g., SELinux/TrustZone policy) to restrict which processes may open and issue commands to the VM management interface (trade-off: policy tuning effort and risk of breaking legitimate memory-management clients), and remove unnecessary local user accounts or shell access on the platform so that PR:L footholds are harder to obtain. Monitor for unexpected firmware-level exceptions, stack/crash anomalies or privilege-escalation attempts in device logs, and track the advisory's revision history for the exact patched versions as they become available.
More in Qam8255p Firmware
View allA Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Rated critic
Information Disclosure while parsing beacon frame in STA. Rated critical severity (CVSS 9.1), this vulnerability is remo
Memory corruption while loading an ELF segment in TEE Kernel. Rated high severity (CVSS 8.8), this vulnerability is low
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. Rated high se
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments. Rated high severi
Memory corruption while running VK synchronization with KASAN enabled. Rated high severity (CVSS 8.4), this vulnerabilit
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today