CVE-2025-47346: Qualcomm Sa8145p Buffer Overflow Flaw

CVE-2025-47346 Overview

CVE-2025-47346 is a memory corruption vulnerability affecting a wide range of Qualcomm firmware components. The flaw resides in a trusted application (TA) that processes secure logging commands. When the TA handles a crafted secure logging command, it performs an out-of-bounds write [CWE-787], corrupting memory inside the Trusted Execution Environment (TEE).

A local, low-privileged attacker on an affected device can trigger the vulnerable code path and compromise the confidentiality, integrity, and availability of the trusted application. Qualcomm addressed the issue in its January 2026 Security Bulletin.

Critical Impact
A local attacker with low privileges can corrupt memory inside a Qualcomm trusted application, potentially executing code within the TEE and undermining secure-world isolation on more than 100 Snapdragon, FastConnect, and Qualcomm Automotive platforms.

Affected Products

Qualcomm Snapdragon Mobile Platforms (Snapdragon 4 Gen 2, 6 Gen 1, 8 Gen 3, AR1 Gen 1) and modem-RF systems (X32, X35, X72, X75)
Qualcomm Automotive platforms (SA6145P, SA6150P, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155P, SA8195P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P)
Qualcomm connectivity and audio silicon (FastConnect 6200/6700/6900/7800, QCA6xxx series, WCD9xxx, WCN3xxx/6xxx/7xxx, WSA88xx)

Discovery Timeline

2026-01-07 - CVE CVE-2025-47346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47346

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in a Qualcomm trusted application that handles secure logging commands. Trusted applications execute inside the Trusted Execution Environment on Snapdragon and Qualcomm Automotive silicon, isolated from the normal-world operating system by the QSEE/QTEE architecture.

When the TA processes a secure logging command supplied from the non-secure world, it writes past the bounds of a buffer. This corrupts adjacent TEE memory structures. The result is memory corruption that can influence subsequent control flow inside the trusted application.

Exploitation is local. The attacker must run code on the device, typically as a low-privileged application or system component that can send commands to the trusted application via the TEE client interface. No user interaction is required.

Root Cause

The TA does not correctly validate size or offset parameters supplied in the secure logging command before writing data into an internal buffer. This missing bounds check allows an attacker-controlled length or index to drive a write beyond the intended memory region, satisfying the conditions of an out-of-bounds write.

Attack Vector

A malicious application, or any code executing in the normal world with permission to invoke the TA, opens a session to the trusted application and issues a crafted secure logging command. The command's parameters are chosen to trigger the out-of-bounds write. Because the corruption occurs inside the TEE, a successful exploit can undermine the security guarantees that protect keys, DRM state, biometric templates, and other secrets held in secure memory.

No public proof-of-concept code has been released for CVE-2025-47346. See the Qualcomm January 2026 Security Bulletin for advisory details.

Detection Methods for CVE-2025-47346

Indicators of Compromise

Unexpected TA crashes, TEE panics, or QSEE/QTEE reset events logged in kernel or bootloader logs
Applications without a legitimate need invoking secure logging command IDs on the TEE client interface
Repeated malformed or oversized command buffers submitted to trusted application sessions

Detection Strategies

Baseline which packages and system components are expected to communicate with the secure logging TA and alert on deviations
Correlate TEE fault or restart events with the process that last opened a TA session to identify a likely trigger
Monitor for privilege escalation or unauthorized access to keys shortly after TEE anomalies, which can indicate successful TA compromise

Monitoring Recommendations

Ingest device firmware, kernel, and TEE logs into a central data lake and retain them long enough to support post-incident forensics
Enable mobile threat defense telemetry on managed devices to surface anomalous local code execution
Track deployment of the January 2026 Qualcomm firmware update across the fleet and flag devices that remain on vulnerable builds

How to Mitigate CVE-2025-47346

Immediate Actions Required

Inventory devices and embedded systems that use the affected Snapdragon, Qualcomm Automotive, FastConnect, QCA, WCD, WCN, and WSA components
Apply the OEM firmware update that incorporates Qualcomm's January 2026 patch as soon as it is released for each device model
Restrict installation of untrusted applications on affected mobile and automotive endpoints until patched

Patch Information

Qualcomm published the fix in the Qualcomm January 2026 Security Bulletin. Device OEMs must integrate the updated firmware into their platform releases. End users receive the fix through vendor OTA updates; enterprises should track OEM advisories tied to the January 2026 Qualcomm bulletin.

Workarounds

Enforce application allowlisting and mobile device management policies that block sideloading on affected devices
Reduce the number of processes permitted to open sessions to the affected trusted application where the platform allows such restrictions
For automotive and IoT deployments, isolate affected components from untrusted networks and third-party workloads until firmware updates are applied

bash

# Example: verify Qualcomm security patch level on Android before/after update
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.security_patch