CVE-2025-47349: Qualcomm Fastconnect 6900 Use-After-Free

CVE-2025-47349 Overview

CVE-2025-47349 is a memory corruption vulnerability affecting a broad range of Qualcomm firmware components, including FastConnect connectivity chips, WCD audio codecs, WSA smart speaker amplifiers, and multiple SC and XG series SoCs. The flaw occurs while processing an escape call and is classified under [CWE-823: Use of Out-of-range Pointer Offset]. A local, authenticated attacker with low privileges can trigger the condition to achieve high impact on confidentiality, integrity, and availability. Qualcomm published fixes as part of the October 2025 security bulletin.

Critical Impact
Successful exploitation can corrupt kernel or driver memory, enabling local privilege escalation or arbitrary code execution within firmware components on affected Qualcomm platforms.

Affected Products

Qualcomm FastConnect 6900 and FastConnect 7800 firmware
Qualcomm WCD9378C, WCD9380, WCD9385 audio codec firmware and WSA8840, WSA8845, WSA8845H smart speaker amplifier firmware
Qualcomm SC8380XP, QCC2072, and X2000/XG101 series firmware

Discovery Timeline

2025-10-09 - CVE-2025-47349 published to NVD
October 2025 - Qualcomm releases fix in the October 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47349

Vulnerability Analysis

The vulnerability resides in the handling of an escape call within the affected Qualcomm firmware components. Escape calls provide a mechanism for user-space software to invoke vendor-specific functionality inside a driver or firmware layer. When the escape call is dispatched, the affected code path derives a pointer using data that has not been properly validated. This produces an out-of-range pointer offset, which is then dereferenced during subsequent processing.

Because the flaw sits in firmware code servicing driver requests, corruption occurs in a privileged execution context. An attacker holding a local account with the ability to issue driver IOCTLs can shape the escape call parameters to control the offset. The result is memory corruption with high impact on confidentiality, integrity, and availability.

Root Cause

The root cause is improper validation of pointer arithmetic during escape call processing, matching [CWE-823]. The firmware uses attacker-influenced values to compute a memory address without bounds enforcement, producing a pointer that references memory outside the intended object. Subsequent read or write operations on that pointer corrupt adjacent structures within the driver or firmware runtime.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker interacts with the vulnerable driver interface, typically through an IOCTL or vendor escape mechanism exposed by the graphics, audio, or connectivity stack. By crafting parameter values that steer the out-of-range offset toward sensitive kernel or firmware structures, the attacker can escalate privileges or destabilize the device. No public proof-of-concept is available at this time, and the vulnerability is not listed in CISA KEV.

No verified exploitation code is publicly available. Refer to the Qualcomm Security Bulletin October 2025 for vendor technical details.

Detection Methods for CVE-2025-47349

Indicators of Compromise

Unexpected kernel panics, system crashes, or driver restarts on devices using affected Qualcomm FastConnect, WCD, WSA, or SC/XG series firmware.
Anomalous IOCTL activity targeting Qualcomm audio, Wi-Fi, or Bluetooth driver interfaces from non-system processes.
Firmware or driver logs recording invalid parameter errors during escape call processing.

Detection Strategies

Monitor endpoint telemetry for local processes issuing high volumes of vendor-specific IOCTLs to Qualcomm driver stacks.
Correlate crash dumps with escape call code paths in the affected firmware components to identify exploitation attempts.
Track privilege changes and process lineage following interactions with the vulnerable drivers.

Monitoring Recommendations

Ingest Windows and Android kernel crash telemetry into a centralized data lake for retrospective analysis.
Alert on unsigned or unexpected user-space binaries accessing Qualcomm driver device objects.
Baseline normal escape call patterns for managed devices and flag deviations for review.

How to Mitigate CVE-2025-47349

Immediate Actions Required

Inventory endpoints, mobile devices, and IoT hardware that ship with the affected Qualcomm firmware components listed in the advisory.
Deploy the October 2025 Qualcomm firmware updates through the OEM update channel as soon as they are made available.
Restrict local access to affected systems and enforce least-privilege policies to limit which accounts can invoke vulnerable driver interfaces.

Patch Information

Qualcomm addressed CVE-2025-47349 in the Qualcomm Security Bulletin October 2025. Because Qualcomm ships firmware to OEMs, apply updates supplied by the device manufacturer for each affected platform, including FastConnect 6900/7800, WCD and WSA audio components, SC8380XP, QCC2072, and the X2000 and XG101 series.

Workarounds

No vendor-provided workarounds exist; apply the OEM firmware update as the primary remediation.
Where patching is delayed, limit installation of untrusted local applications and enforce application allowlisting on affected devices.
Disable or restrict access to non-essential Qualcomm driver interfaces where feature usage permits.

bash

# Verify installed patch level on Android devices (example)
adb shell getprop ro.build.version.security_patch