CVE-2025-47347: Qualcomm Qam8255p Buffer Overflow Flaw

CVE-2025-47347 Overview

CVE-2025-47347 is a memory corruption vulnerability affecting the virtual memory management interface across a wide range of Qualcomm automotive, connectivity, and server firmware platforms. The flaw is triggered while processing control commands and is classified as a stack-based buffer overflow [CWE-121]. A local, authenticated attacker with low privileges can leverage the issue to corrupt kernel memory and compromise device integrity. Qualcomm addressed the vulnerability in the October 2025 security bulletin.

Critical Impact
Local low-privileged attackers can trigger stack-based memory corruption in the Qualcomm virtual memory management interface, potentially achieving code execution with elevated privileges and full compromise of confidentiality, integrity, and availability on affected chipsets.

Affected Products

Qualcomm automotive platforms including QAM8255P, QAM8295P, QAM8620P, QAM8650P, and QAM8775P firmware
Qualcomm connectivity chipsets including QCA6574A, QCA6595, QCA6688AQ, QCA6696, QCA6698AQ, and QCA6797AQ firmware
Qualcomm Snapdragon Auto (SA6145P, SA8155P, SA8255P, SA8295P, SA8540P, SA8650P, SA8770P, SA8775P, SA9000P) and SRV1H/SRV1L/SRV1M server platforms

Discovery Timeline

2025-10-09 - CVE-2025-47347 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47347

Vulnerability Analysis

The vulnerability resides in the virtual memory management interface exposed by affected Qualcomm firmware. When the interface processes control commands from a caller, insufficient bounds checking on command parameters allows attacker-controlled data to overflow a fixed-size stack buffer. The overflow overwrites adjacent stack frames, including saved return addresses and control data used by the kernel-mode handler.

Because the flaw impacts confidentiality, integrity, and availability, successful exploitation can leak sensitive memory, alter kernel state, and cause denial-of-service conditions on the affected system-on-chip. The attack requires local access and low privileges but no user interaction, making it viable from a compromised application on automotive infotainment, telematics, or embedded server platforms.

Root Cause

The root cause is a classic stack-based buffer overflow [CWE-121] in the control-command dispatch path of the virtual memory management interface. The handler copies attacker-supplied fields into a stack buffer without validating length constraints against the destination size.

Attack Vector

Exploitation requires local execution on the device. An attacker who has already achieved code execution as a low-privileged user or process invokes the vulnerable virtual memory management control command with a malformed payload. The resulting memory corruption can be shaped to hijack control flow within the higher-privileged component. See the Qualcomm Security Bulletin October 2025 for the vendor-supplied technical description.

// No verified proof-of-concept is available for CVE-2025-47347.
// Refer to the Qualcomm October 2025 Security Bulletin for details.

Detection Methods for CVE-2025-47347

Indicators of Compromise

Unexpected crashes, kernel panics, or watchdog resets on affected Qualcomm platforms during normal userland activity
Repeated invocations of virtual memory management control interfaces from non-system userland processes
Firmware log entries referencing memory management fault handlers on the impacted chipsets

Detection Strategies

Enumerate device firmware versions against the Qualcomm October 2025 bulletin fixed-version list to identify unpatched assets
Monitor process behavior on Android- or Linux-based automotive stacks for unprivileged binaries issuing ioctl or syscall traffic targeting virtual memory management interfaces
Correlate application crashes with subsequent privilege elevation events to surface post-exploitation activity

Monitoring Recommendations

Ingest telemetry from vehicle and edge device fleets into a centralized analytics pipeline for cross-fleet anomaly detection
Alert on new or unsigned processes attempting to access low-level memory management APIs on Qualcomm-based systems
Track firmware update compliance and flag devices that remain on pre-October 2025 firmware baselines

How to Mitigate CVE-2025-47347

Immediate Actions Required

Inventory all Qualcomm-based devices matching the affected chipset list and identify unpatched firmware revisions
Apply the Qualcomm October 2025 firmware updates via the OEM distribution channel as soon as they are made available
Restrict local execution on affected devices by enforcing application allowlisting and removing unused third-party software

Patch Information

Qualcomm published the fix in the Qualcomm Security Bulletin October 2025. Because Qualcomm ships firmware to original equipment manufacturers (OEMs), device owners must obtain patched builds through the corresponding vehicle, module, or platform vendor. Track OEM advisories to confirm which downstream releases incorporate the October 2025 baseline.

Workarounds

No vendor-supplied workaround is documented; firmware updates are the authoritative remediation
Reduce attack surface by limiting which processes can load native code or interact with kernel interfaces on affected platforms
For automotive deployments, disable or sandbox untrusted applications on infotainment and telematics domains until patched firmware is deployed

bash

# Example: verify installed firmware build on an Android-based automotive platform
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.fingerprint
# Compare the reported build against the OEM release notes incorporating the
# Qualcomm October 2025 security bulletin fixes.