CVE-2025-47367 Overview
CVE-2025-47367 is a memory corruption vulnerability in multiple Qualcomm firmware components. The flaw occurs while accessing a buffer during IOCTL (Input/Output Control) processing. A local, authenticated attacker with low privileges can trigger an out-of-bounds write [CWE-787] to corrupt kernel memory. Successful exploitation impacts confidentiality, integrity, and availability on affected devices. Qualcomm addressed the issue in the November 2025 Security Bulletin.
Critical Impact
Local attackers with low privileges can corrupt kernel memory through malformed IOCTL requests, leading to privilege escalation or device compromise across Snapdragon compute, audio codec, and FastConnect firmware components.
Affected Products
- Qualcomm Snapdragon compute platforms (SC8380XP, SC8280XP-AB, SC8280XP-BB, Snapdragon 7c+ Gen 3)
- Qualcomm QCM6490, QCS5430, QCS6490, QCM5430, and Video Collaboration VC3 platform firmware
- Qualcomm FastConnect 6700/6900/7800, WCD937x/938x audio codecs, WSA883x/884x smart speaker amplifiers, and X2000/XG101 series firmware
Discovery Timeline
- 2025-11-04 - CVE-2025-47367 published to NVD
- November 2025 - Qualcomm publishes fix in the Qualcomm Security Bulletin November 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47367
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds write [CWE-787] triggered during IOCTL processing in Qualcomm firmware components. When user-space code issues an IOCTL request, the driver accesses a buffer without properly enforcing size or index constraints. This access reads or writes memory outside the intended buffer boundary, corrupting adjacent kernel structures.
Because the flaw resides in kernel-mode driver code, successful exploitation can yield elevated privileges or destabilize the operating system. The attack requires local access and valid credentials on the target device, meaning it is most relevant to post-compromise scenarios or malicious applications running on Snapdragon-based hardware.
Root Cause
The root cause is insufficient validation of buffer bounds when handling IOCTL parameters supplied from user space. The driver does not verify that offsets, lengths, or indices remain within allocated buffer limits before performing a write operation. This missing check permits an attacker-controlled value to direct writes beyond the buffer, corrupting neighboring memory regions.
Attack Vector
Exploitation requires local access to a device using vulnerable Qualcomm firmware and the ability to execute code with low privileges. An attacker crafts a malicious IOCTL request containing manipulated size or offset fields and sends it to the vulnerable driver. When the driver processes the request, the out-of-bounds write corrupts kernel memory, which the attacker can leverage for privilege escalation, denial of service, or leaking sensitive data. No user interaction is required.
No public proof-of-concept exploit is available for this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-47367
Indicators of Compromise
- Unexpected kernel crashes, panics, or reboots on Snapdragon-based devices, particularly following interaction with third-party applications
- Kernel logs (dmesg, logcat) showing driver faults, invalid memory access, or IOCTL error traces from Qualcomm audio, FastConnect, or compute drivers
- Unauthorized privilege elevation or the appearance of processes running with kernel or system-level privileges
Detection Strategies
- Monitor endpoint telemetry for anomalous IOCTL invocation patterns against Qualcomm driver device nodes
- Inspect crash dumps and firmware logs for signatures of out-of-bounds writes originating in Qualcomm kernel modules
- Correlate application installation events with subsequent kernel-level faults to identify potentially malicious apps targeting the driver
Monitoring Recommendations
- Enable centralized log collection from mobile and compute devices to capture kernel and driver events
- Track firmware versions across the fleet and alert on devices missing the November 2025 Qualcomm patch level
- Watch for unsigned or newly installed applications that invoke low-level device ioctls shortly after installation
How to Mitigate CVE-2025-47367
Immediate Actions Required
- Apply the firmware updates published in the Qualcomm November 2025 Security Bulletin as soon as OEM builds are available
- Inventory all devices using affected chipsets, including Snapdragon compute platforms, audio codecs, and FastConnect Wi-Fi/Bluetooth modules
- Restrict installation of untrusted applications on affected devices until firmware updates are deployed
Patch Information
Qualcomm has released patches for this vulnerability as part of the Qualcomm Security Bulletin November 2025. Device OEMs must integrate the updated firmware into their platform builds and ship it to end users. Verify the security patch level on affected devices matches or exceeds November 2025.
Workarounds
- Limit local access to affected devices and enforce strong authentication to reduce the pool of potential attackers
- Deploy mobile application vetting and allowlisting to prevent low-privileged users from running untrusted code that could invoke vulnerable ioctls
- Apply the principle of least privilege to user accounts and disable unnecessary developer or debugging interfaces on production devices
# Verify Android security patch level on affected devices
adb shell getprop ro.build.version.security_patch
# Expected result: 2025-11-01 or later for mitigation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
