CVE-2025-47352: Qualcomm Fastconnect 7800 Buffer Overflow

CVE-2025-47352 Overview

CVE-2025-47352 is a memory corruption vulnerability in multiple Qualcomm firmware components that occurs while processing audio streaming operations. The flaw stems from improper validation of array indexes ([CWE-129]) and can be triggered by a local, low-privileged attacker without user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected device. Qualcomm addressed the issue in its November 2025 Security Bulletin, which covers FastConnect 7800, QCC2072, WCD9378C, WSA8840/8845/8845H, X2000077/086/090/092/094, and XG101002/032/039 platforms.

Critical Impact
A local attacker can corrupt memory in the audio streaming path to achieve arbitrary code execution or complete denial of service on affected Qualcomm firmware components.

Affected Products

Qualcomm FastConnect 7800 firmware
Qualcomm WCD9378C, WSA8840, WSA8845, and WSA8845H audio codec firmware
Qualcomm QCC2072, X2000077/086/090/092/094, and XG101002/032/039 firmware

Discovery Timeline

2025-11-04 - CVE-2025-47352 published to NVD
2025-11 - Qualcomm releases the November 2025 Security Bulletin with fixes
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47352

Vulnerability Analysis

The vulnerability resides in the audio streaming logic implemented in the firmware of Qualcomm audio and connectivity SoCs. During processing of audio streaming operations, the firmware fails to properly validate an index or offset before it is used to access an internal buffer or structure. An attacker with local access and low privileges on a host that communicates with these components can supply crafted parameters that push the index beyond intended bounds. The result is memory corruption inside the firmware's execution context, which sits below the operating system's security boundary.

Root Cause

The issue is classified as [CWE-129] Improper Validation of Array Index. The audio streaming handler trusts an input value used to select or offset into a buffer without confirming that the value falls within a safe range. Because the check is missing or incomplete, writes or reads occur outside the intended memory region.

Attack Vector

Exploitation requires local access to a device that contains the affected firmware, such as a mobile phone, laptop, or embedded system integrating the FastConnect 7800 or the listed audio codecs. The attacker interacts with the audio streaming interface using low-privileged APIs. No user interaction is required. Successful triggering of the corrupted state can lead to code execution inside the firmware, escalation of privileges on the host, or a persistent denial of service affecting audio and connectivity functions.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Qualcomm November 2025 Security Bulletin for component-specific technical details.

Detection Methods for CVE-2025-47352

Indicators of Compromise

Unexpected crashes, resets, or watchdog events involving audio DSP or WLAN/audio combo firmware on affected Qualcomm platforms.
Kernel logs referencing faults in audio streaming drivers or Qualcomm codec subsystems (for example, wsa88xx, wcd9378, or fastconnect modules).
Local processes with low privileges invoking audio streaming ioctls or shared-memory interfaces at abnormal rates.

Detection Strategies

Compare installed firmware and vendor patch levels against the fixed builds listed in the Qualcomm November 2025 Security Bulletin.
Monitor endpoint telemetry for local privilege escalation chains that follow anomalous audio subsystem activity.
Enable OEM device-integrity attestation where available to identify firmware tampering on mobile and embedded devices.

Monitoring Recommendations

Collect and centralize kernel and HAL logs from endpoints that use the affected Qualcomm components, and alert on repeated audio driver faults.
Track process behavior on Android and Windows-on-Snapdragon hosts for unsigned or untrusted binaries accessing audio streaming APIs.
Correlate crash telemetry with subsequent suspicious process launches to identify possible post-exploitation activity.

How to Mitigate CVE-2025-47352

Immediate Actions Required

Apply the OEM firmware and driver updates that incorporate the fixes from the Qualcomm November 2025 Security Bulletin as soon as they are available for each device model.
Inventory endpoints, mobile devices, and embedded systems that ship with the listed FastConnect, WCD, WSA, QCC, X2000, and XG101 components.
Restrict local access to affected devices and require full-disk encryption plus screen-lock policies to raise the bar for local exploitation.

Patch Information

Qualcomm has published fixes in the Qualcomm November 2025 Security Bulletin. Because these are chipset firmware fixes, they are delivered to end users through OEM security updates. Confirm that your device vendor has integrated the November 2025 Qualcomm patch level before considering the issue remediated.

Workarounds

No official workaround exists; the vendor fix must be applied through an OEM update.
Limit installation of untrusted local applications that can access audio streaming APIs on affected devices.
On managed fleets, enforce mobile device management policies that block sideloaded applications and enforce minimum patch levels.

bash

# Example: verify Android security patch level on an affected device
adb shell getprop ro.build.version.security_patch
# Compare the returned date against the OEM build that integrates the
# Qualcomm November 2025 Security Bulletin fixes.