CVE-2025-47353: Qualcomm Qam8255p Use-After-Free Flaw

CVE-2025-47353 Overview

CVE-2025-47353 is a memory corruption vulnerability affecting multiple Qualcomm firmware components. The flaw occurs while processing a request sent from the Guest Virtual Machine (GVM), enabling a local attacker with low privileges to trigger memory corruption in the host component. The vulnerability is tracked under [CWE-749: Exposed Dangerous Method or Function] and was published in the Qualcomm November 2025 Security Bulletin.

Exploitation requires local access and low privileges, but successful exploitation impacts confidentiality, integrity, and availability. The vulnerability affects a broad range of automotive, connectivity, and server-class Qualcomm chipsets.

Critical Impact
A local attacker inside a guest VM can corrupt memory in a privileged host firmware component, potentially leading to code execution, information disclosure, or denial of service across the virtualization boundary.

Affected Products

Qualcomm automotive platforms: SA7255P, SA7775P, SA8255P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P
Qualcomm QAM series: QAM8255P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M, SRV1H, SRV1M
Qualcomm connectivity chipsets: QCA6595, QCA6698AQ, QCA6797AQ

Discovery Timeline

2025-11-04 - CVE-2025-47353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47353

Vulnerability Analysis

The vulnerability resides in the interface that processes requests originating from a Guest Virtual Machine (GVM) in Qualcomm's hypervisor-backed firmware stack. When the host-side component parses a request from the guest, insufficient validation of the incoming request causes memory corruption in the privileged handler.

The issue is classified under [CWE-749], which describes an exposed dangerous method or function. In this case, a host-facing interface accessible to guest workloads accepts input that leads to unsafe memory operations. Because the attack originates from a lower-privileged guest and impacts a higher-privileged host component, it effectively crosses a trust boundary. Successful exploitation can compromise the confidentiality, integrity, and availability of the host firmware environment.

Root Cause

The root cause is inadequate validation of a request structure passed from a Guest VM to the host component. The interface exposes a handler that operates on guest-controlled data without sufficient bounds or state checks, allowing the guest to influence memory operations performed at a higher privilege level.

Attack Vector

The attack vector is local. An attacker who has already obtained low-privileged code execution inside a Guest VM running on an affected Qualcomm platform crafts a malicious request and sends it through the GVM-to-host interface. The corrupted request drives the host component into an invalid memory state, which the attacker can leverage for further impact. No user interaction is required.

No public proof-of-concept is available at the time of publication. Refer to the Qualcomm November 2025 Security Bulletin for vendor-supplied technical detail.

Detection Methods for CVE-2025-47353

Indicators of Compromise

Unexpected crashes, resets, or watchdog reboots of host firmware services that handle GVM requests on affected Qualcomm SoCs.
Anomalous log entries from the hypervisor or host component referencing malformed guest requests or memory faults.
Guest VM workloads exhibiting elevated interaction rates with host interfaces beyond normal operational baselines.

Detection Strategies

Monitor kernel and hypervisor logs on affected platforms for abnormal termination of host-side services processing GVM communication.
Correlate guest workload behavior with host firmware crash events to identify guests attempting to exploit the GVM interface.
Deploy firmware attestation and integrity monitoring where supported to detect post-exploitation modifications.

Monitoring Recommendations

Baseline normal GVM-to-host request patterns and alert on statistical deviations, including request rate spikes and malformed payloads.
Ingest platform crash dumps and hypervisor telemetry into a centralized SIEM for cross-host correlation.
Track vendor advisories and firmware version inventories to identify unpatched devices in the fleet.

How to Mitigate CVE-2025-47353

Immediate Actions Required

Inventory all deployed devices using the affected Qualcomm chipsets and firmware, particularly automotive and IoT platforms.
Apply the firmware updates referenced in the Qualcomm November 2025 Security Bulletin as soon as vendor OEMs release patched images.
Restrict which workloads may run inside Guest VMs on affected platforms, limiting exposure to untrusted code.

Patch Information

Qualcomm addressed CVE-2025-47353 in its November 2025 security bulletin. Because Qualcomm firmware is distributed through OEM device manufacturers, patched builds must be obtained from the vendor of the specific device or platform. Consult the Qualcomm November 2025 Security Bulletin for component-level fix identifiers and coordinate with the OEM for release timing.

Workarounds

Enforce strict guest workload isolation and limit deployment of untrusted or third-party code inside Guest VMs on affected platforms.
Apply the principle of least privilege inside Guest VMs to reduce the likelihood of a low-privileged attacker reaching the vulnerable GVM interface.
Where the platform permits, disable or restrict access to non-essential host-facing interfaces exposed to Guest VMs until firmware updates are applied.

bash

# Example: verify Qualcomm firmware component versions on the target device
# (exact commands depend on OEM tooling and platform)
fwupdmgr get-devices
fwupdmgr refresh
fwupdmgr update