Qualcomm FastConnect CVE-2025-47355
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
IOCTL invocation requires local access with low privileges, so AV:L and PR:L; out-of-bounds write in firmware yields full code-execution impact, hence C:H/I:H/A:H.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
2DescriptionCVE.org
Memory corruption while invoking remote procedure IOCTL calls.
AnalysisAI
Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.
Technical ContextAI
The vulnerability is a memory corruption (CWE-787, out-of-bounds write) in Qualcomm firmware components responsible for handling remote procedure calls (RPC) over IOCTL (input/output control) interfaces. An IOCTL is a system call used by user-space processes to communicate with kernel drivers, and in this context it is used to invoke remote procedures on the firmware running on connectivity chips (FastConnect, WCN) and audio codecs (WCD/WSA), as well as compute platforms (Snapdragon 8cx/7c+ Gen 3). The CVE description states that memory corruption occurs while invoking remote procedure IOCTL calls, suggesting that improper validation of input buffer size, offset, or index leads to an out-of-bounds write. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation requires local access, low complexity, low privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. The CPE strings identify the affected firmware as unspecified versions (:-), meaning all versions until patched, across a broad set of Qualcomm chipsets. This is a classic high-severity-but-locally-scoped flaw where the raw CVSS of 7.8 overstates remote risk because the attacker must already have a local foothold with at least low privileges to invoke the vulnerable IOCTL interface.
RemediationAI
Apply the firmware updates provided in the Qualcomm October 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html), which is the primary source for patches; consult that advisory for exact fix versions and availability, as no specific patched version is provided in the CVE data. Because the flaw requires local access with low privileges to invoke the vulnerable IOCTL interface, the most effective compensating controls focus on reducing local attack surface: restrict local interactive access and ensure that only trusted applications with explicitly granted privileges can issue IOCTL calls to the affected firmware components. However, this may break legitimate functionality of connectivity and audio subsystems, so test carefully. Additionally, enforce the principle of least privilege to limit which users or processes can run code on the device, and monitor for anomalous IOCTL activity to detect exploitation attempts. No public exploit code is available, which lowers immediate risk, but unpatched devices remain vulnerable to a local attacker who already has a foothold.
More in Fastconnect 6700 Firmware
View allQualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received
Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no
Cryptographic issue occurs due to use of insecure connection method while downloading.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today