CVE-2025-47365: Qualcomm QAM8255P Buffer Overflow Flaw

CVE-2025-47365 Overview

CVE-2025-47365 is a memory corruption vulnerability affecting a broad range of Qualcomm automotive and connectivity firmware platforms. The flaw occurs when the affected component processes large input data received from a remote source over a communication interface. The underlying weakness is classified as an integer overflow or wraparound [CWE-190], which can lead to memory corruption during buffer size calculations.

Qualcomm disclosed the issue in its November 2025 Security Bulletin. Affected products include Snapdragon Automotive platforms such as SA8155P, SA8295P, SA8775P, and QCA-series connectivity chipsets deployed in vehicles and embedded systems.

Critical Impact
A local attacker with low privileges can trigger memory corruption to compromise confidentiality, integrity, and availability of the affected firmware component.

Affected Products

Qualcomm Snapdragon Automotive firmware (SA8155P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P)
Qualcomm QAM-series firmware (QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M)
Qualcomm QCA connectivity firmware (QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU) and SRV1H, SRV1L, SRV1M

Discovery Timeline

2025-11-04 - CVE-2025-47365 published to NVD
2025-11-04 - Qualcomm publishes November 2025 Security Bulletin addressing the issue
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47365

Vulnerability Analysis

The vulnerability resides in firmware logic that processes inbound data received through a communication interface from a remote source. When the incoming payload is unusually large, an integer overflow occurs during size arithmetic used to allocate or copy the buffer. The overflow produces a truncated length value that no longer reflects the true size of the input.

Subsequent memory operations use the truncated length as a bound while the full attacker-controlled data is written into an undersized buffer. This mismatch produces out-of-bounds writes and heap corruption within the firmware address space. Successful exploitation can allow an authenticated local attacker to influence execution flow, corrupt adjacent structures, or trigger denial of service in the affected subsystem.

Exploitation requires local access with low privileges, and no user interaction is needed. Because the affected components run inside vehicle infotainment, telematics, and connectivity stacks, corruption can cascade into safety-relevant subsystems.

Root Cause

The root cause is improper validation of a length or count field prior to arithmetic, matching the pattern described by [CWE-190] Integer Overflow or Wraparound. The firmware does not verify that the size derived from remote input remains within safe bounds before allocation or copying.

Attack Vector

An attacker with local, low-privileged access to the affected device sends a crafted large payload through the exposed communication interface. The interface path bridges a remote data source into the vulnerable firmware component, where the malformed size triggers the overflow condition. See the Qualcomm November 2025 Security Bulletin for component-specific details.

No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2025-47365

Indicators of Compromise

Unexpected crashes, watchdog resets, or reboots in Snapdragon automotive or QCA connectivity subsystems
Firmware logs showing abnormally large payload sizes or truncated length fields on communication interfaces
Anomalous processes writing to shared memory regions used by the affected firmware components

Detection Strategies

Monitor firmware crash dumps and kernel logs for signatures consistent with heap corruption or aborts in the affected components
Baseline normal message sizes for the relevant communication interfaces and alert on outliers that exceed protocol expectations
Correlate device telemetry with the CPE list published in the Qualcomm advisory to identify unpatched fleet units

Monitoring Recommendations

Ingest vehicle and device telemetry into a centralized data lake for longitudinal analysis of firmware faults
Track patch state across affected Qualcomm SKUs and flag devices still running vulnerable firmware builds
Alert on repeated crashes of the same firmware component across multiple devices, which may indicate coordinated exploitation attempts

How to Mitigate CVE-2025-47365

Immediate Actions Required

Inventory all devices using the affected Qualcomm SKUs listed in the Qualcomm advisory
Apply the firmware updates referenced in the Qualcomm November 2025 Security Bulletin as they become available from OEM integrators
Restrict local access to affected devices and their diagnostic or debug interfaces

Patch Information

Qualcomm addressed CVE-2025-47365 in the November 2025 Security Bulletin. OEMs and Tier-1 integrators must incorporate the updated firmware into their downstream builds and distribute over-the-air or service-based updates to end devices. Verify each impacted product family against the vendor bulletin before certifying remediation.

Workarounds

Limit exposure of the vulnerable communication interface to trusted, authenticated peers only
Enforce strict message size validation at any upstream gateway or middleware layer that fronts the affected component
Isolate affected subsystems from safety-critical networks until vendor firmware updates are applied

bash

# Example: verify current firmware build against vendor advisory
# Replace <device> and <component> with your platform-specific identifiers
adb shell getprop ro.vendor.build.fingerprint
adb shell cat /vendor/firmware/<component>/version