What is the CVSS score of CVE-2025-47349?

CVE-2025-47349 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm FastConnect are affected by CVE-2025-47349?

A memory-corruption flaw affects Qualcomm FastConnect 6900/7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 audio codecs and WSA8840/WSA8845/WSA8845H smart-amp firmware…

How to fix or mitigate CVE-2025-47349?

Within 24 hours, inventory every asset, product line, and firmware build containing FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378C/WCD9380/WCD9385, or WSA8840/WSA8845/WSA8845H, confirm the affected silicon revisions with Qualcomm and our OEM partners, and open a vendor tracking ticket requesting patch timelines and any pre-release mitigation guidance; brief mobile and device engineering leads that no vendor-released patch is identified at time of analysis and that exploitation requires an authenticated local attacker with low privileges, so the priority is reducing the chance of untrusted code running on these devices. Within 7 days, tighten the local attack surface by enforcing application allowlisting and strict mobile device management controls on affected fleets, restricting sideloading and developer/debug modes, hardening or disabling unused driver and audio/amp interfaces, and increasing telemetry on crashes and anomalous access to protected memory regions so that attempted abuse is detectable; also validate that least-privilege enforcement and app sandboxing are functioning as intended on all impacted platforms. Within 30 days, deploy the Qualcomm/OEM firmware update as soon as an exact vendor fix version is published and re-verify silicon coverage after each release, and in the interim re-assess risk monthly using updated EPSS and CISA KEV data since current status is no public exploit identified at time of analysis.

Qualcomm FastConnect CVE-2025-47349

HIGH

Use of Out-of-range Pointer Offset (CWE-823)

2025-10-09 product-security@qualcomm.com

Buffer Overflow Memory Corruption Fastconnect 6900 Firmware Fastconnect 7800 Firmware Qcc2072 Firmware Sc8380xp Firmware Wcd9378c Firmware Wcd9380 Firmware Wcd9385 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware X2000077 Firmware X2000086 Firmware X2000090 Firmware X2000092 Firmware X2000094 Firmware Xg101002 Firmware Xg101032 Firmware Xg101039 Firmware

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Escape call is reachable only locally (AV:L) by a low-privilege app (PR:L) with no user interaction; memory corruption enables full code control, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:08 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption while processing an escape call.

AnalysisAI

Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-823 (Use of Out-of-range Pointer Offset): an 'escape' call - the classic driver interface by which an unprivileged user-mode client passes a parameter block to a kernel or firmware-resident handler for processing - is reached with parameters that cause an out-of-bounds pointer offset to be used during a memory operation, corrupting memory outside the intended buffer. The affected CPEs are all firmware entries (cpe:2.3:o:qualcomm:*_firmware), covering the FastConnect 6900 and 7800 Wi-Fi/Bluetooth combo platforms, QCC2072 (audio SoC), SC8380XP (Snapdragon compute platform), the WCD9378C, WCD9380 and WCD9385 audio codecs, the WSA8840, WSA8845 and WSA8845H smart speaker amplifiers, plus the X2000xxx and XG101xxx reference/board designs listed in the tags. These are the components whose drivers expose the escape interface to user space; because the flaw lives in the parameter-handling path rather than in a network protocol, the attack surface is strictly local (AV:L) and reachable only from a process that already has a foothold on the device under a low-privileged security context (PR:L, UI:N, no non-default configuration required).

RemediationAI

Patch status: Patch available per vendor advisory - Qualcomm published this issue in its October 2025 Security Bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), so the fix ships as updated firmware/driver images distributed by Qualcomm to device OEMs; no standalone fix version string is published in the available data, so end users and fleet owners should apply the latest OEM firmware update that references the October 2025 Qualcomm bulletin for the specific device. Because Qualcomm does not patch devices directly, track the OEM/carrier firmware release notes for the handset, PC, audio accessory or module in question and verify the bulletin identifier before closing out. Until the OEM image is available and deployed, compensating controls must be tailored to a local, low-privilege attacker: enforce strict application vetting and disallow sideloading or installation of untrusted APKs/packages on affected devices (trade-off: limits developer/testing workflows and some enterprise app deployment paths); harden the kernel's access-control policy (SELinux/seccomp/AppArmor) so that untrusted application domains cannot reach the driver escape/ioctl entry point used by the affected Qualcomm components (trade-off: policy changes can break legitimate audio, Wi-Fi/BT or power-management tooling and require careful per-device validation); and deploy mobile/endpoint threat detection to flag privilege-escalation behaviour from installed apps, accepting that this is detective rather than preventive. Removing potentially unwanted or untrusted applications from affected devices reduces the PR:L foothold needed to trigger the escape call, but does not substitute for the vendor firmware fix. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so remediation can proceed on a normal (not emergency) patching cadence - though EPSS will change if exploit code appears.