What is the CVSS score of CVE-2025-47354?

CVE-2025-47354 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qualcomm DSP Service are affected by CVE-2025-47354?

A memory-corruption flaw in the DSP service of Qualcomm's FastConnect, QMP1000, SM-series, and Snapdragon mobile and wearable platforms could allow a low-privilege local process on an affected device…

How to fix or mitigate CVE-2025-47354?

Within 24 hours, determine whether any FastConnect, QMP1000, SM-series, or Snapdragon mobile/wearable devices are present in the managed estate by extracting hardware and firmware inventories from MDM, asset, and procurement records, and notify mobility, endpoint, and embedded engineering owners that no vendor-released patch has been identified at time of analysis. Within 7 days, open tracking cases with Qualcomm and the relevant device OEMs to obtain fix timelines and per-SKU firmware versions, use MDM to enforce policies blocking sideloading and unknown-source app installation on affected device classes, and verify that mobile threat defense, exploit-mitigation settings, and endpoint logging are enabled on those devices so local privilege-escalation attempts are detectable. Within 30 days, build a firmware remediation schedule mapping each affected chipset SKU to its OEM-supplied update as soon as one is published, extend the inventory effort to wearables, connected modules, and any QMP1000-based equipment operating outside standard MDM coverage, and re-assess priority if a public exploit emerges or EPSS rises materially; if exploitation is confirmed, escalate to emergency change procedures and consider device quarantine or replacement for the highest-value user groups.

Qualcomm DSP Service CVE-2025-47354

HIGH

Use After Free (CWE-416)

2025-10-09 product-security@qualcomm.com

Buffer Overflow Use After Free Memory Corruption Fastconnect 6200 Firmware Fastconnect 6700 Firmware Fastconnect 7800 Firmware Qmp1000 Firmware Sm6475 Firmware Sm7435 Firmware Sm8735 Firmware Sm8750 Firmware Sm8750p Firmware Snapdragon 4 Gen 2 Mobile Platform Firmware Snapdragon 6 Gen 1 Mobile Platform Firmware Sw5100 Firmware Sw5100p Firmware Sxr2330p Firmware Sxr2350p Firmware Wcd9370 Firmware Wcd9375 Firmware Wcd9378 Firmware Wcd9380 Firmware Wcd9385 Firmware Wcd9395 Firmware Wcn3950 Firmware Wcn3988 Firmware Wcn6755 Firmware Wcn7750 Firmware Wcn7860 Firmware Wcn7861 Firmware Wcn7880 Firmware Wcn7881 Firmware Wsa8810 Firmware Wsa8815 Firmware Wsa8830 Firmware Wsa8832 Firmware Wsa8835 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware Snapdragon W5 Gen 1 Wearable Platform Firmware

7.8

CVSS 3.1 · Vendor: qualcomm

Severity by source

Vendor (qualcomm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

DSP service is reachable only locally so AV:L; a low-privilege on-device process suffices (PR:L), no user interaction, and a UAF yields full code-execution impact (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (qualcomm).

CVSS VectorVendor: qualcomm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:09 vuln.today

CVE Published

Oct 09, 2025 - 04:16 cve.org

HIGH 7.8

DescriptionCVE.org

Memory corruption while allocating buffers in DSP service.

AnalysisAI

Local privilege escalation in Qualcomm's DSP service buffer-allocation path affects numerous FastConnect, QMP1000, SM-series, and Snapdragon mobile/wearable platform firmware components. The flaw is a use-after-free (CWE-416) that allows an authenticated local attacker with low privileges-such as a malicious app or compromised unprivileged process able to reach the DSP IPC interface-to corrupt memory and potentially execute code in the DSP context, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is 0.09%, so priority is bounded by the local-only attack vector despite the 7.8 CVSS score.

Technical ContextAI

The affected technology is Qualcomm's Digital Signal Processor (DSP) service, which manages buffer allocation for offloaded audio, sensor, connectivity, and related workloads on a wide range of Qualcomm chipsets. CVE-2025-47354 is classified as CWE-416 (Use After Free), indicating that memory can be freed and then reused during buffer allocation, leading to memory corruption. The CPE data maps the issue to firmware for FastConnect 6200/6700/7800, QMP1000, SM6475/SM7435/SM8735/SM8750/SM8750P, Snapdragon 4 Gen 2, Snapdragon 6 Gen 1, SW5100/SW5100P, SXR2330P/SXR2350P, multiple WCD audio codecs, WCN connectivity parts, WSA audio amplifiers, and the Snapdragon W5 Gen 1 wearable platform. Exploitation requires local access with low privileges (CVSS PR:L) and no user interaction; the local attack vector prevents remote triggering.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; consult Qualcomm's October 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html for device-specific fixes and OEM firmware updates. Apply OEM firmware updates as soon as they are available for the specific chipset and device model. Until then, compensating controls include enforcing strict app sandboxing so unprivileged apps cannot reach the DSP service IPC path, blocking sideloading of untrusted applications (trade-off: affects developer and enterprise sideloading workflows), and monitoring for local privilege-escalation behavior targeting DSP-related services. Because the vector is local and requires PR:L, these controls reduce exposure but do not eliminate a compromised-process scenario.