CVE-2025-47342 Overview
CVE-2025-47342 is a transient denial-of-service (DoS) vulnerability affecting multiple Qualcomm Bluetooth audio chipsets and sound platforms. The flaw is triggered when multi-profile concurrency arises with Qualcomm High Speed (QHS) enabled. Qualcomm disclosed the issue in the Qualcomm Security Bulletin October 2025. The vulnerability is classified under [CWE-416] Use After Free and impacts firmware running on QCC5161, QCC7225, QCC7226, QCC7228, and S3/S5 Sound Platform variants. An adversary positioned on an adjacent network with low privileges can disrupt audio service availability without user interaction.
Critical Impact
A use-after-free condition triggered by concurrent Bluetooth profile activity with QHS enabled can produce a transient DoS on affected Qualcomm audio chipsets, interrupting service for connected devices.
Affected Products
- Qualcomm QCC5161 and QCC7225/7226/7228 firmware
- Qualcomm S3 Sound Platform and S3 Gen 2 Sound Platform firmware
- Qualcomm S5 Sound Platform and S5 Gen 2 Sound Platform firmware
Discovery Timeline
- 2025-10-09 - CVE-2025-47342 published to NVD
- 2025-10-21 - Last updated in NVD database
Technical Details for CVE-2025-47342
Vulnerability Analysis
The vulnerability resides in the Bluetooth firmware stack of Qualcomm audio platforms that support Qualcomm High Speed (QHS) link mode. QHS is a proprietary low-latency Bluetooth transport used by Snapdragon Sound and related audio profiles. When multiple Bluetooth profiles operate concurrently with QHS enabled, the firmware mishandles object lifetime tracking. This produces a use-after-free condition that destabilizes the audio subsystem. The result is a transient DoS that interrupts audio streaming or device responsiveness until the connection or device state resets. The flaw does not expose data confidentiality, but it does impact integrity and availability of audio services on affected devices.
Root Cause
The root cause is a use-after-free condition [CWE-416] in the firmware code that manages concurrent Bluetooth profile sessions. When the QHS path is active and multiple profiles contend for shared session resources, the firmware references a structure after it has been released. Subsequent access to the freed memory leads to unpredictable behavior and a service halt within the audio firmware.
Attack Vector
An attacker within Bluetooth range can drive the device into multi-profile concurrency conditions, such as overlapping calls, media, and control profiles, while QHS negotiation is in progress. Low privileges are required because the attacker only needs to interact with the radio. No user interaction is required to trigger the condition. Successful exploitation interrupts audio playback or causes the chipset to drop active sessions.
No verified public proof-of-concept is available. Refer to the Qualcomm Security Bulletin October 2025 for vendor technical details.
Detection Methods for CVE-2025-47342
Indicators of Compromise
- Repeated unexpected resets of Bluetooth audio sessions on devices using Qualcomm QCC51xx/QCC72xx or S3/S5 Sound Platform firmware.
- Firmware logs showing concurrent profile activations alongside QHS negotiation followed by an abnormal session teardown.
- Spikes in Bluetooth link disconnections correlated with multi-profile usage (call plus media plus control).
Detection Strategies
- Inventory endpoints, peripherals, and embedded devices that ship with the affected Qualcomm chipsets and validate firmware versions against the October 2025 bulletin.
- Monitor host-side Bluetooth stack logs (HCI traces) for repeated link supervision timeouts or controller resets tied to QHS-capable peers.
- Correlate user-reported audio outages with proximity events and concurrent profile usage to identify exploitation patterns.
Monitoring Recommendations
- Track vendor firmware update telemetry to confirm patched versions are deployed across managed mobile and IoT fleets.
- Alert on anomalous Bluetooth controller restarts on endpoints that integrate affected sound platforms.
- Review wireless intrusion detection logs for unexpected pairing or profile-negotiation activity in sensitive environments.
How to Mitigate CVE-2025-47342
Immediate Actions Required
- Apply the firmware updates referenced in the Qualcomm Security Bulletin October 2025 as soon as device OEMs publish downstream releases.
- Identify all assets containing affected QCC51xx, QCC72xx, and S3/S5 Sound Platform firmware and prioritize patch deployment.
- Coordinate with OEM and ODM partners to verify update availability for embedded audio products that may not receive automatic updates.
Patch Information
Qualcomm has released fixed firmware for the affected chipsets as part of the October 2025 security bulletin. Device manufacturers must integrate the patched firmware into downstream product updates. Confirm the deployed firmware revision matches or exceeds the version specified by Qualcomm in the bulletin.
Workarounds
- Where patching is delayed, disable QHS or Snapdragon Sound features in device settings if the option is exposed by the OEM.
- Limit simultaneous Bluetooth profile usage on at-risk devices, such as avoiding concurrent calls and media streaming.
- Restrict Bluetooth pairing to trusted peripherals and disable discoverability in untrusted environments to reduce exposure to adjacent attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
