CVE-2025-47355: Qualcomm Fastconnect 6700 Buffer Overflow

CVE-2025-47355 Overview

CVE-2025-47355 is a memory corruption vulnerability in multiple Qualcomm firmware components. The flaw occurs when the affected firmware processes remote procedure IOCTL calls, leading to an out-of-bounds write condition [CWE-787]. The vulnerability affects a broad range of Qualcomm chipsets, including FastConnect Wi-Fi/Bluetooth modules, Snapdragon compute platforms, WCD/WCN/WSA audio and connectivity components, and multiple XG and X2000 series firmware.

An authenticated local attacker can trigger the memory corruption to compromise confidentiality, integrity, and availability on the affected device. Qualcomm published details in the October 2025 Security Bulletin.

Critical Impact
A local, low-privileged attacker can trigger memory corruption in Qualcomm firmware IOCTL handlers, potentially achieving code execution in the firmware context across dozens of chipset families.

Affected Products

Qualcomm FastConnect 6700, 6900, and 7800 firmware
Qualcomm Snapdragon 7c+ Gen 3 Compute and Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, SC8280XP-BB) firmware
Qualcomm WCD9378C/9380/9385, WCN3660B/3680B/3980, WSA8830/8835/8840/8845/8845H, QCC2072, SC8380XP, X2000 series, and XG101 series firmware

Discovery Timeline

2025-10-09 - CVE-2025-47355 published to NVD
October 2025 - Qualcomm publishes fix details in the Qualcomm Security Bulletin October 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47355

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] that occurs when Qualcomm firmware processes remote procedure IOCTL calls. Remote procedure IOCTL interfaces let higher-level software issue control commands to firmware components such as Wi-Fi, Bluetooth, audio codecs, and compute subsystems. When these commands are handled, the firmware writes to memory based on caller-supplied parameters without adequately validating length or index values.

Exploitation requires local access and low privileges. No user interaction is required. Successful exploitation can corrupt firmware memory structures, leading to arbitrary code execution or denial of service within the affected firmware component. Because the affected components include connectivity and audio subsystems on mobile and compute platforms, corruption can affect the trust boundary between the host OS and dedicated silicon.

Root Cause

The root cause is missing or insufficient bounds checking on parameters supplied to remote procedure IOCTL handlers. Attacker-controlled input reaches a memory write operation where the destination offset or length is not validated against the target buffer size, producing an out-of-bounds write.

Attack Vector

The attack vector is local. An attacker with the ability to run code on the host device and reach the vulnerable IOCTL interface, typically via a user-mode driver or system service that proxies calls to firmware, can send crafted requests that trigger the memory corruption. No specific proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available for CVE-2025-47355. Refer to the Qualcomm Security Bulletin for authoritative technical details.

Detection Methods for CVE-2025-47355

Indicators of Compromise

Unexpected crashes, resets, or kernel panics involving Qualcomm firmware components such as WLAN, Bluetooth, or audio subsystems
Firmware crash dumps referencing IOCTL dispatch functions or remote procedure call handlers
Anomalous privilege transitions from user-mode processes accessing Qualcomm driver interfaces (/dev/wcnss, /dev/wlan, audio codec IOCTLs)

Detection Strategies

Monitor kernel and firmware logs for repeated IOCTL errors, subsystem restarts, or watchdog resets tied to affected Qualcomm components
Correlate driver crash events with the local process that issued the triggering IOCTL to identify potential exploitation attempts
Track patch level (ro.build.version.security_patch on Android, firmware revisions on Windows on Snapdragon devices) to identify unpatched endpoints

Monitoring Recommendations

Deploy endpoint telemetry that captures driver load events, IOCTL request anomalies, and privilege escalation attempts on Snapdragon-based endpoints
Alert on unsigned or unusual processes interacting with Qualcomm HAL and RPC interfaces
Continuously audit device firmware versions against vendor bulletin baselines

How to Mitigate CVE-2025-47355

Immediate Actions Required

Inventory all Qualcomm-based endpoints, including mobile devices, Windows on Snapdragon laptops, and IoT hardware using affected chipsets
Apply the firmware updates referenced in the Qualcomm October 2025 Security Bulletin as they are made available through OEMs and carriers
Restrict untrusted local code execution on affected devices, particularly on shared or multi-user systems

Patch Information

Qualcomm has released fixes for CVE-2025-47355 as documented in the Qualcomm Security Bulletin October 2025. Distribution to end users depends on OEM and carrier update cycles. Confirm that device firmware and vendor-supplied driver packages reflect the October 2025 patch level or later.

Workarounds

No official workaround is published by Qualcomm; applying the vendor patch is the required remediation
Enforce application allowlisting and least-privilege on affected endpoints to reduce the pool of processes that can reach vulnerable IOCTL interfaces
Where feasible, disable or restrict access to affected wireless, audio, or compute subsystems until patched firmware is deployed

bash

# Example: check Android security patch level to verify remediation
adb shell getprop ro.build.version.security_patch
# Expected output should be 2025-10-01 or later after the OEM ships the fix