CVE-2025-47360 Overview
CVE-2025-47360 is a stack-based buffer overflow [CWE-121] in multiple Qualcomm firmware components. The flaw occurs while processing a client message during device management operations. A local, low-privileged attacker can trigger memory corruption to compromise confidentiality, integrity, and availability of the affected device.
Qualcomm disclosed the issue in the November 2025 Security Bulletin. The vulnerability affects a broad range of automotive and connectivity platforms, including SA8155P, SA8295P, SA8775P, and multiple QCA6xxx Wi-Fi/Bluetooth SoCs used in embedded and in-vehicle systems.
Critical Impact
Local attackers with low privileges can corrupt memory in the device management path and achieve code execution or persistent device compromise on affected Qualcomm platforms.
Affected Products
- Qualcomm automotive platforms: SA6145P, SA6150P, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155P, SA8195P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P firmware
- Qualcomm QAM and SRV platforms: QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M, SRV1H, SRV1L, SRV1M firmware
- Qualcomm QCA connectivity SoCs: QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU firmware
Discovery Timeline
- 2025-11-04 - CVE-2025-47360 published to NVD
- 2025-11-04 - Qualcomm publishes November 2025 Security Bulletin
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47360
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow classified under [CWE-121]. It resides in the code path that parses client messages during device management operations on Qualcomm firmware. Insufficient validation of input length or structure allows an attacker-controlled message to write beyond the bounds of a stack buffer.
Exploitation requires local access with low privileges and no user interaction. Successful exploitation corrupts adjacent stack memory, including saved return addresses and control data. This can lead to arbitrary code execution within the context of the affected firmware component.
Because the affected components run on automotive and connectivity SoCs, exploitation can impact safety-adjacent subsystems. The scope remains unchanged, but confidentiality, integrity, and availability of the target are fully compromised.
Root Cause
The root cause is missing or inadequate bounds checking on data copied from a client message into a fixed-size stack buffer inside the device management handler. When the message payload exceeds the expected size, the copy operation overwrites stack frame data.
Attack Vector
The attack vector is local. An attacker with a foothold on the device, such as a compromised process able to communicate with the device management interface, sends a crafted message. The vulnerable handler processes the message and overflows the stack buffer, corrupting control flow.
No verified proof-of-concept code has been published. See the Qualcomm Security Bulletin November 2025 for vendor technical details.
Detection Methods for CVE-2025-47360
Indicators of Compromise
- Unexpected crashes, resets, or watchdog reboots of the device management service or associated firmware component on affected Qualcomm chipsets.
- Anomalous local processes issuing malformed or oversized messages to the device management interface.
- Kernel or firmware logs showing stack corruption, aborts, or exceptions in device management code paths.
Detection Strategies
- Monitor firmware crash telemetry and coredumps for repeated faults in the device management handler on affected SoCs.
- Baseline legitimate local clients that interact with device management IPC channels and alert on new or unauthorized callers.
- Correlate abnormal process activity on host operating systems with firmware-side reset events indicating potential exploitation attempts.
Monitoring Recommendations
- Enable verbose logging on device management components where supported and forward logs to a central analytics platform.
- Track patch state of Qualcomm firmware across fleets and flag devices running builds prior to the November 2025 bulletin fixes.
- For automotive deployments, integrate SoC crash and reset telemetry into vehicle security operations monitoring.
How to Mitigate CVE-2025-47360
Immediate Actions Required
- Inventory all devices using the Qualcomm SoCs listed in the affected products and identify current firmware versions.
- Coordinate with OEMs and Tier 1 suppliers to obtain firmware updates aligned with the Qualcomm November 2025 Security Bulletin.
- Restrict local access to affected systems and limit which processes can reach the device management interface.
Patch Information
Qualcomm has released fixes as part of the November 2025 Security Bulletin. Device manufacturers must integrate the updated firmware into their platform-specific images and distribute them to end devices. Refer to the Qualcomm Security Bulletin November 2025 for component-level version information.
Workarounds
- Apply the principle of least privilege to local accounts and processes that can send messages to device management interfaces.
- Isolate untrusted workloads from safety-critical subsystems on affected automotive platforms using hypervisor or domain separation controls.
- Where feasible, disable or gate non-essential device management features until vendor firmware updates are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
