CVE-2025-47354: Qualcomm Fastconnect Use-After-Free Flaw

CVE-2025-47354 Overview

CVE-2025-47354 is a memory corruption vulnerability in the Digital Signal Processor (DSP) service across a broad set of Qualcomm chipsets and firmware. The flaw occurs during buffer allocation and is classified as a use-after-free condition [CWE-416]. A local, authenticated attacker with low privileges can trigger the condition to corrupt memory and compromise the confidentiality, integrity, and availability of the affected device. The vulnerability affects mobile platforms, wearable platforms, FastConnect connectivity modules, audio codecs, and Wi-Fi/Bluetooth combo chips.

Critical Impact
Successful exploitation allows a local attacker to corrupt memory in the Qualcomm DSP service, potentially leading to arbitrary code execution within a privileged firmware context.

Affected Products

Qualcomm Snapdragon 4 Gen 2, Snapdragon 6 Gen 1, and Snapdragon W5+ Gen 1 platforms
Qualcomm FastConnect 6200, 6700, and 7800 connectivity modules
Qualcomm SM6475, SM7435, SM8735, SM8750, SM8750P, SW5100, SW5100P, SXR2330P, SXR2350P, and QMP1000 chipsets, plus WCD/WCN/WSA audio, Wi-Fi, and speaker amplifier firmware

Discovery Timeline

2025-10-09 - CVE-2025-47354 published to NVD alongside the Qualcomm October 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47354

Vulnerability Analysis

The vulnerability resides in the Qualcomm DSP service, a privileged firmware component that mediates communication between application processors and the Hexagon DSP. During buffer allocation, the service mishandles object lifetime, resulting in a use-after-free condition tracked under [CWE-416]. When the freed memory region is reused, subsequent operations dereference stale pointers, allowing attacker-controlled data to influence execution.

Exploitation requires local access and low privileges, meaning a malicious application running on the device can reach the vulnerable code path without user interaction. Because the DSP service operates with elevated privileges, successful memory corruption can escalate an attacker from an unprivileged app context into a firmware-level component that handles audio, sensor, modem, and machine-learning workloads.

Root Cause

The root cause is improper reference tracking during buffer allocation in the DSP service. Freed buffer descriptors remain reachable through cached pointers, and the allocator does not invalidate stale references before reuse. This creates a window in which a subsequent allocation returns memory still referenced elsewhere, producing a classic use-after-free primitive.

Attack Vector

An attacker delivers a crafted sequence of DSP service requests from a local application, forcing allocation and premature release of a buffer. The attacker then reclaims the freed region with controlled contents and triggers the stale reference. Because no user interaction is required and the affected surface is exposed to standard application-level clients, the attack chain is fully automatable within a malicious app or a compromised process on the device.

// No verified public proof-of-concept is available for CVE-2025-47354.
// Refer to the Qualcomm October 2025 Security Bulletin for technical details.

Detection Methods for CVE-2025-47354

Indicators of Compromise

Unexpected crashes, resets, or subsystem restarts of the Hexagon DSP or adsprpc driver on affected Qualcomm devices
Kernel or firmware logs referencing invalid memory access, freed-buffer reuse, or DSP service faults during buffer allocation
Installation or execution of unsigned or unknown applications that interact heavily with DSP RPC interfaces

Detection Strategies

Monitor mobile device management (MDM) telemetry for devices reporting repeated DSP subsystem crashes or SSR (subsystem restart) events
Correlate application install events with subsequent DSP fault signatures to identify apps abusing the DSP service
Track firmware and patch level attributes across the fleet to identify devices still running vulnerable Qualcomm builds

Monitoring Recommendations

Ingest Android and OEM device logs into a centralized SIEM and alert on adsprpc, fastrpc, or DSP service error patterns
Enforce continuous inventory of Qualcomm chipset firmware versions and cross-reference against the Qualcomm Security Bulletin October 2025
Alert on privilege boundary violations where an application context is followed by DSP-service anomalies

How to Mitigate CVE-2025-47354

Immediate Actions Required

Apply the October 2025 Qualcomm security patch through the OEM update channel as soon as it is available for your device model
Inventory all Qualcomm-based mobile, wearable, IoT, and XR devices in the environment and prioritize patching of chipsets listed in the advisory
Restrict sideloading and enforce application allow-listing on managed devices to reduce the attack surface for local exploitation

Patch Information

Qualcomm addressed CVE-2025-47354 in the Qualcomm Security Bulletin October 2025. Fixes are distributed to original equipment manufacturers (OEMs), who must integrate the updated firmware into device-level security patches. Administrators should confirm that managed devices report the October 2025 or later Android security patch level and the corresponding vendor firmware build.

Workarounds

No official workaround is published; patching through the OEM is the supported remediation
Reduce exposure by disallowing untrusted third-party applications, enforcing Play Protect or equivalent scanning, and applying MDM policies that block unknown sources
Segment and monitor high-risk devices that cannot receive timely OEM updates and consider replacing devices that no longer receive vendor security updates

bash

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch

# Confirm Qualcomm chipset and firmware build for inventory reconciliation
adb shell getprop ro.hardware
adb shell getprop ro.vendor.build.fingerprint