CVE-2025-47361: Qualcomm Qam8255p Buffer Overflow Flaw

CVE-2025-47361 Overview

CVE-2025-47361 is a memory corruption vulnerability affecting a wide range of Qualcomm automotive and connectivity firmware components. The flaw occurs when a local actor triggers a subsystem crash using an out-of-range identifier, resulting in improper validation of an array index [CWE-129]. Successful exploitation can lead to memory corruption within the affected subsystem, impacting confidentiality, integrity, and availability. Qualcomm addressed the issue in the November 2025 security bulletin.

Critical Impact
A local, low-privileged attacker can trigger memory corruption in Qualcomm firmware subsystems by supplying an out-of-range identifier during a subsystem crash operation, potentially enabling code execution in privileged firmware contexts.

Affected Products

Qualcomm automotive platforms: SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P, SA7255P, SA7775P
Qualcomm QAM and server-class platforms: QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M, SRV1H, SRV1L, SRV1M
Qualcomm QCA connectivity chipsets: QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU

Discovery Timeline

2025-11-04 - CVE-2025-47361 published to the National Vulnerability Database (NVD)
2025-11 - Qualcomm releases fix in the Qualcomm Security Bulletin November 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47361

Vulnerability Analysis

CVE-2025-47361 is classified as an Improper Validation of Array Index issue [CWE-129]. The affected code path handles subsystem crash requests and accepts an identifier that selects the target subsystem. When the identifier falls outside the expected valid range, the code fails to reject the request and proceeds to index into a bounded data structure, corrupting adjacent memory.

Exploitation requires local access and low privileges on the target platform, and no user interaction is needed. The impact spans confidentiality, integrity, and availability because memory corruption in the affected subsystem context can be leveraged to alter execution flow or destabilize the platform.

Root Cause

The root cause is missing or insufficient bounds checking on a caller-supplied index used to look up subsystem state during crash handling. Because the identifier is trusted rather than validated against the array size, an out-of-range value produces an out-of-bounds write that corrupts memory belonging to unrelated firmware structures.

Attack Vector

An attacker with local access to a process able to invoke the affected subsystem-crash interface submits a crafted identifier outside the accepted range. The interface reaches the vulnerable indexing operation, and the resulting write corrupts memory in the privileged firmware component. On automotive and connectivity SoCs, this may destabilize the platform or enable further privilege escalation depending on which structures are corrupted.

No public proof-of-concept exploit is available for CVE-2025-47361, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics of the exploitation primitive have not been published by Qualcomm; refer to the Qualcomm Security Bulletin November 2025 for vendor guidance.

Detection Methods for CVE-2025-47361

Indicators of Compromise

Unexpected subsystem crashes or restart loops in Qualcomm firmware logs referencing invalid or out-of-range subsystem identifiers.
Kernel or firmware panic traces that map back to subsystem-restart handlers on affected SAxxxx, QAMxxxx, QCAxxxx, or SRVxx platforms.
Repeated invocations of subsystem-crash interfaces from non-system user contexts.

Detection Strategies

Correlate device-side crash telemetry with process activity to flag local callers invoking subsystem-crash operations with anomalous parameters.
Baseline normal subsystem restart behavior for automotive head units and telematics platforms so that abnormal crash patterns become identifiable.
Ingest firmware and platform logs into a centralized data lake to support historical hunt queries for out-of-range identifier values.

Monitoring Recommendations

Monitor privileged interfaces exposed to userspace on affected Qualcomm platforms for anomalous call frequency and argument ranges.
Track firmware and OS patch level across the vehicle or device fleet to identify hosts still running vulnerable images.
Alert on repeated subsystem restarts, which may indicate probing of the vulnerable code path.

How to Mitigate CVE-2025-47361

Immediate Actions Required

Apply the Qualcomm November 2025 firmware update to all affected platforms as soon as OEMs make it available.
Inventory all deployed Qualcomm automotive and connectivity SoCs against the affected components list and prioritize devices exposed to untrusted local code.
Restrict local access on affected devices to trusted, signed applications only, reducing the pool of callers able to reach the vulnerable interface.

Patch Information

Qualcomm published the fix in the Qualcomm Security Bulletin November 2025. Downstream OEMs and Tier-1 integrators must incorporate the updated firmware into their platform builds and distribute updates to end devices through their standard over-the-air or service channels.

Workarounds

Where patching is delayed, limit which user contexts can invoke subsystem-crash or subsystem-restart interfaces through platform access-control policies.
Harden the local attack surface by removing or restricting unnecessary debug, diagnostic, and developer interfaces on production units.
Enforce secure boot and code-signing on all affected devices so that only vendor-approved software can attempt to reach privileged firmware interfaces.

bash

# Verify installed firmware/build fingerprint on Android-based automotive platforms
adb shell getprop ro.build.fingerprint
adb shell getprop ro.vendor.build.security_patch