CVE-2025-47351: Qualcomm Fastconnect 6200 Buffer Overflow

CVE-2025-47351 Overview

CVE-2025-47351 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware, including FastConnect, Snapdragon mobile platforms, and audio codec components. The flaw occurs when the affected firmware processes user-supplied buffers, resulting in an integer overflow condition classified under [CWE-190]. A local attacker with low privileges can trigger the condition to corrupt memory and compromise confidentiality, integrity, and availability of the affected device. Qualcomm disclosed the issue in its October 2025 security bulletin. The vulnerability affects mobile handsets, connected devices, and embedded platforms that integrate the impacted Qualcomm silicon and firmware.

Critical Impact
Local low-privileged attackers can trigger memory corruption in Qualcomm firmware, potentially leading to code execution in a privileged context on affected mobile and embedded devices.

Affected Products

Qualcomm FastConnect 6200, 6700, 6900, and 7800 connectivity platforms and firmware
Qualcomm Snapdragon SM8750, SM8750P, SM8850, SM8850P, SG6150, and SG6150P platforms and firmware
Qualcomm WCD937x/WCD939x audio codecs, WCN3950/3988/786x/788x wireless chipsets, and WSA88xx smart speaker amplifiers

Discovery Timeline

2025-10-09 - CVE-2025-47351 published to NVD
October 2025 - Qualcomm publishes advisory in its October 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47351

Vulnerability Analysis

The vulnerability resides in firmware routines that process buffers supplied by user-space code. When the firmware calculates buffer sizes or offsets, an integer overflow ([CWE-190]) allows the computed length to wrap, producing a value smaller than the attacker-controlled input. Subsequent copy or indexing operations then write past intended bounds, corrupting adjacent memory structures.

Because the affected components run in privileged firmware or driver contexts, successful exploitation can escalate from a low-privileged local process to arbitrary code execution within the firmware's trust boundary. The impact spans confidentiality, integrity, and availability, which is consistent with control-flow hijacking or persistent state corruption on the device.

Root Cause

The root cause is insufficient validation of arithmetic performed on user-supplied buffer parameters. Length or offset values are not checked for overflow before being used in allocation or copy routines, allowing wraparound in fixed-width integer types.

Attack Vector

Exploitation requires local access with low privileges, such as an unprivileged app on a mobile device or a local process on an embedded platform. No user interaction is required. The attacker submits crafted input to a driver or firmware interface that forwards the values into the vulnerable buffer-processing path.

No verified proof-of-concept exploit is publicly available. Refer to the Qualcomm advisory for component-specific technical details.

Detection Methods for CVE-2025-47351

Indicators of Compromise

Unexpected kernel or firmware crash logs referencing the affected Qualcomm drivers or wireless/audio subsystems
Unprivileged processes issuing unusual ioctl or shared-memory calls targeting FastConnect, WCN, WCD, or WSA driver interfaces
Devices exhibiting repeated reboots or subsystem restarts after installation of untrusted third-party applications

Detection Strategies

Inventory mobile and embedded assets against the affected CPE list to identify devices running vulnerable Qualcomm firmware
Correlate mobile device management (MDM) telemetry with OEM patch levels to detect devices missing the October 2025 Qualcomm patch bundle
Monitor endpoint and mobile telemetry for anomalous local privilege escalation attempts and driver-level exceptions

Monitoring Recommendations

Ingest device patch-level and firmware-version data into a centralized analytics platform to track exposure over time
Alert on newly installed applications that request low-level access to wireless, audio, or codec interfaces on affected chipsets
Track vendor advisories for updates to CVE-2025-47351 and related October 2025 bulletin entries

How to Mitigate CVE-2025-47351

Immediate Actions Required

Apply Qualcomm's October 2025 firmware updates as delivered by device OEMs and mobile carriers
Prioritize patching of enterprise-managed mobile fleets and embedded devices that expose the affected chipsets
Restrict installation of untrusted applications on affected devices until patches are deployed

Patch Information

Qualcomm addressed CVE-2025-47351 in the October 2025 Security Bulletin. OEMs consuming Qualcomm reference firmware must integrate the fix into their device-specific images and ship it through their standard update channels. Enterprise administrators should verify device patch levels through MDM reporting.

Workarounds

Enforce application allowlisting on managed devices to reduce the risk of a local unprivileged attacker running exploit code
Disable or restrict features that depend on affected wireless or audio subsystems where the vendor patch is not yet available
Isolate embedded devices running vulnerable Qualcomm firmware on segmented networks with restricted local access

bash

# Example: query Android device patch level via adb to identify unpatched hosts
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.security_patch