CVE-2025-47341 Overview
CVE-2025-47341 is a memory corruption vulnerability in multiple Qualcomm chipsets and firmware components. The flaw occurs while processing an image encoding completion event. It is classified as a buffer copy without checking the size of input [CWE-120]. An attacker with local, low-privileged access to an affected device can trigger memory corruption to compromise confidentiality, integrity, and availability. Qualcomm disclosed the issue in its October 2025 Security Bulletin, and the vulnerability affects a broad range of Snapdragon compute, FastConnect, WCD/WSA audio codec, and QCM/QCS series firmware.
Critical Impact
Local, low-privileged attackers can trigger memory corruption in Qualcomm firmware while an image encoding completion event is processed, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Qualcomm FastConnect 6700, 6900, and 7800 firmware
- Qualcomm Snapdragon 7c+ Gen 3 Compute and Snapdragon 8cx Gen 3 Compute (SC8280XP-AB/BB) firmware
- Qualcomm QCM5430, QCM6490, QCS5430, QCS6490, SC8380XP, WCD9370/9375/9378C/9380/9385, WSA8830/8835/8840/8845/8845H, and X2000/XG101 series firmware
Discovery Timeline
- 2025-10-09 - CVE-2025-47341 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47341
Vulnerability Analysis
The vulnerability resides in firmware code that handles the completion notification for an image encoding operation. When the completion event is delivered, the affected component copies data into a buffer without validating that the source length fits within the destination. This is a classic buffer copy without checking size of input weakness [CWE-120], which corrupts adjacent memory structures. The flaw affects both wireless connectivity firmware (FastConnect, WCD, WSA) and Snapdragon compute platforms, indicating shared code paths across multiple Qualcomm product families.
Root Cause
The root cause is the absence of a bounds check on attacker-controllable input length before a memory copy operation runs inside the image encoding completion handler. Because the copy occurs on data attached to an asynchronous completion event, the corrupted memory can influence subsequent control-flow or data structures used by the firmware. Successful exploitation requires only local access with low privileges, no user interaction, and no elevated permissions.
Attack Vector
A local attacker running low-privileged code on an affected device can craft an image encoding request such that the completion event carries oversized or malformed data. Processing this event overwrites memory beyond the intended destination buffer. Depending on which structures are overwritten, the outcome ranges from denial of service to arbitrary code execution in the firmware context. See the Qualcomm Security Bulletin October 2025 for vendor-supplied technical context.
No public proof-of-concept exploit is available for CVE-2025-47341 at the time of publication.
Detection Methods for CVE-2025-47341
Indicators of Compromise
- Unexpected crashes, resets, or kernel panics on devices using affected Qualcomm chipsets, particularly after image encoding workloads
- Anomalous firmware or driver telemetry referencing image encoder subsystems on Snapdragon and FastConnect platforms
- Local processes making unusual sequences of image encoding requests followed by device instability
Detection Strategies
- Monitor kernel and driver logs for repeated faults originating from image encoder or media completion handlers on Qualcomm-based devices
- Track installed firmware and BIOS/UEFI versions against the fixed builds listed in the Qualcomm October 2025 bulletin to identify unpatched fleet devices
- Correlate application-level access to media encoder APIs with subsequent system instability to identify potential exploitation attempts
Monitoring Recommendations
- Ingest OEM firmware inventory and patch level telemetry into a centralized log or SIEM to identify devices still running vulnerable firmware
- Alert on repeated crash dumps or watchdog resets tied to image processing components across managed endpoints
- Include Qualcomm chipset and firmware identifiers in asset inventory reporting so that vulnerability management workflows can prioritize CVE-2025-47341 remediation
How to Mitigate CVE-2025-47341
Immediate Actions Required
- Apply the firmware updates provided by the OEM that consume Qualcomm's October 2025 security patches for all affected Snapdragon, FastConnect, WCD, WSA, QCM, QCS, and X2000/XG101 series devices
- Inventory endpoints, laptops, and embedded devices for the affected chipsets listed in the Qualcomm bulletin and prioritize patch deployment on devices that process untrusted media
- Restrict local access on affected devices and enforce least-privilege for applications that interact with the image encoder subsystem
Patch Information
Qualcomm addressed CVE-2025-47341 in its October 2025 security bulletin. Device OEMs consume these fixes and ship updated firmware to end users. Refer to the Qualcomm Security Bulletin October 2025 for the complete list of fixed components and coordinate with your device manufacturer for platform-specific firmware releases.
Workarounds
- No official workaround has been published by Qualcomm; firmware update is the recommended remediation
- Where patching is delayed, limit installation and execution of untrusted applications that can invoke the image encoder on affected devices
- Disable or restrict non-essential features that rely on the affected media encoding paths until firmware updates are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
