CVE-2025-47343: Qualcomm VC3 Use-After-Free Vulnerability

CVE-2025-47343 Overview

CVE-2025-47343 is a memory corruption vulnerability affecting multiple Qualcomm chipsets and firmware components. The flaw occurs while processing a video session when setting video parameters. An authenticated local attacker with low privileges can trigger the condition to corrupt memory, potentially leading to privilege escalation or arbitrary code execution within the affected component. The vulnerability is tracked under [CWE-822: Untrusted Pointer Dereference] and impacts firmware across Snapdragon connectivity and platform silicon, including FastConnect, WCD, WSA, and QCM series components.

Critical Impact
Local low-privileged attackers can corrupt kernel or driver memory through crafted video session parameters, threatening confidentiality, integrity, and availability of affected Qualcomm-based devices.

Affected Products

Qualcomm Video Collaboration VC3 Platform firmware
Qualcomm FastConnect 6700, 6900, and 7800 firmware
Qualcomm QCM5430, QCM6490, SC8380XP, and WCD/WSA series firmware

Discovery Timeline

2026-01-07 - CVE-2025-47343 published to NVD
2026-01-07 - Qualcomm January 2026 Security Bulletin released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47343

Vulnerability Analysis

The vulnerability resides in the code path that processes a video session while setting video parameters. When an unprivileged local caller supplies crafted parameters, the affected component dereferences an untrusted pointer, corrupting adjacent memory structures. Because the flaw sits inside privileged firmware or driver logic, successful exploitation lets an attacker influence execution beyond the caller's original trust boundary.

The CWE-822 classification indicates that the driver trusts a pointer value that originates, directly or indirectly, from user-controlled input. The attack requires local access to the device and the ability to invoke the video interface, which is typically exposed to applications through system libraries and IPC calls on Snapdragon-based platforms.

Successful exploitation can escalate to code execution in the context of the video stack, leak sensitive memory contents, or crash the component and produce a denial-of-service condition on the device.

Root Cause

The root cause is improper validation of pointer or parameter data supplied to the video session configuration routine. The affected function accepts a parameter structure and follows a pointer without confirming that it references memory owned by the caller or that its layout matches expected bounds. This produces an untrusted pointer dereference during the parameter set operation.

Attack Vector

Exploitation requires local access with low privileges. An attacker running code on the device, such as a malicious application, opens or interacts with the video session interface and issues a request to set video parameters using a crafted payload. No user interaction is required. Because the attack is local, remote network exploitation is not applicable.

No public proof-of-concept exploit has been published for CVE-2025-47343, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Qualcomm January 2026 Security Bulletin for component-level technical details.

Detection Methods for CVE-2025-47343

Indicators of Compromise

Repeated crashes, kernel panics, or restarts of the video or media subsystem on Snapdragon-based devices.
Unexpected privilege changes for processes that interact with the video HAL or camera and media services.
Anomalous invocations of video session IOCTLs originating from untrusted or newly installed applications.

Detection Strategies

Monitor device logs and crash reports (logcat, dmesg, tombstones) for faults in video and media driver components on affected chipsets.
Baseline expected callers of the video session interface and flag processes with no prior history of accessing it.
Correlate application install events with subsequent media stack crashes to identify potential exploitation attempts.

Monitoring Recommendations

Track firmware and patch levels across the fleet to confirm all Qualcomm components listed in the January 2026 bulletin are updated.
Alert on repeated video subsystem faults from a single process or package.
Feed device telemetry into a centralized data lake to hunt for cross-device patterns of media stack instability.

How to Mitigate CVE-2025-47343

Immediate Actions Required

Inventory all devices using the affected Qualcomm firmware components, including FastConnect, WCD, WSA, QCM, and SC8380XP families.
Apply the vendor firmware updates referenced in the Qualcomm January 2026 Security Bulletin as soon as OEM builds become available.
Restrict installation of untrusted third-party applications on affected devices until patches are deployed.

Patch Information

Qualcomm addressed CVE-2025-47343 in the January 2026 Security Bulletin. Device OEMs must integrate the updated firmware into their platform builds and distribute the fix through their standard update channels. Enterprises should validate that shipped devices receive the corresponding OEM security patch level once released.

Workarounds

Limit local access by enforcing strong device authentication and application allowlisting on managed endpoints.
Disable or restrict access to video collaboration functionality on affected VC3 platforms where operationally acceptable until firmware is updated.
Apply mobile device management policies that block sideloading and enforce use of vetted application sources.

bash

# Verify Qualcomm firmware and Android security patch level on managed devices
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.security_patch
adb shell dumpsys package com.qualcomm.qti.services | grep -i version