CVE-2025-47382: Qualcomm Fastconnect 6200 Buffer Overflow

CVE-2025-47382 Overview

CVE-2025-47382 is a memory corruption vulnerability in the Qualcomm boot loader that triggers when an invalid firmware image is loaded. The flaw affects a wide portfolio of Qualcomm Snapdragon, FastConnect, WCN, WCD, WSA, and automotive-class chipsets. Qualcomm disclosed the issue in its December 2025 security bulletin. The weakness maps to [CWE-863] (Incorrect Authorization) in the boot loader's firmware validation path.

Exploitation requires local access with low privileges and no user interaction. A local attacker who can influence the firmware image presented to the boot loader can corrupt memory and compromise confidentiality, integrity, and availability of the device.

Critical Impact
A local attacker with low privileges can trigger memory corruption during boot loader firmware loading, potentially leading to code execution in an early-boot, high-privilege context on affected Qualcomm platforms.

Affected Products

Qualcomm FastConnect 6200, 6700, 6900, and 7800 firmware
Qualcomm Snapdragon mobile platforms including Snapdragon 4 Gen 1, 480/480+ 5G, 695 5G, 8 Gen 3, AR1 Gen 1, and W5+ Gen 1
Qualcomm automotive and IoT SoCs including SA8155P, SA8255P, SA8295P, SA8650P, SA8775P, SA9000P, QCS610, QCS6690, and related WCN, WCD, and WSA firmware families

Discovery Timeline

2025-12-18 - CVE-2025-47382 published to NVD
December 2025 - Qualcomm publishes advisory in the Qualcomm Security Bulletin December 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47382

Vulnerability Analysis

The vulnerability resides in the boot loader routine responsible for loading and validating firmware images. When the boot loader processes an invalid firmware image, it fails to enforce correct authorization or validation on the image's fields before acting on them. This mishandling leads to memory corruption in the boot loader's address space.

Because the boot loader executes very early in the platform boot chain, corruption in this stage can undermine downstream secure boot guarantees. Successful exploitation impacts confidentiality, integrity, and availability of the affected device. The issue is classified under [CWE-863] Incorrect Authorization, indicating that trust decisions are made without adequate checks on the firmware input.

Root Cause

The root cause is inadequate authorization or validation of firmware image contents inside the boot loader. When a malformed or otherwise invalid firmware image is presented, the boot loader continues processing structures it should reject, leading to out-of-bounds or otherwise unsafe memory operations. The defect is present in the firmware components shipped with the affected Qualcomm chipsets rather than in application-layer software.

Attack Vector

The attack vector is local. An attacker needs code execution or another foothold on the device with low privileges to place or influence the firmware image that the boot loader consumes. No user interaction is required. Realistic scenarios include a privileged process writing a crafted image to a partition or storage region read by the boot loader, or a physical/service-mode workflow where firmware payloads are supplied to the loader.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Qualcomm Security Bulletin December 2025 for the vendor's technical description.

Detection Methods for CVE-2025-47382

Indicators of Compromise

Unexpected boot failures, boot loops, or repeated fallback to recovery mode on affected Qualcomm-based devices
Firmware images written to boot or modem partitions that do not match vendor-signed baselines or expected hashes
Device attestation failures or secure boot verification errors reported by MDM or platform integrity services

Detection Strategies

Compare deployed firmware build fingerprints against the fixed builds referenced in the Qualcomm December 2025 bulletin
Monitor mobile and IoT fleets for devices reporting failed remote attestation or unexpected changes in boot loader version strings
Correlate privileged write operations to firmware-hosting partitions with subsequent reboot or boot-failure events

Monitoring Recommendations

Ingest device management, MDM, and platform attestation telemetry into a centralized analytics platform for continuous baseline comparison
Alert on any OEM firmware update event that is not initiated by an authorized update channel
Track vendor security bulletins for the affected chipsets and map advisories to inventoried devices

How to Mitigate CVE-2025-47382

Immediate Actions Required

Inventory all devices built on the affected Qualcomm chipsets listed in the December 2025 bulletin, including phones, wearables, XR devices, automotive, and IoT gateways
Apply OEM firmware updates that incorporate Qualcomm's December 2025 patch as soon as they are released for each affected model
Restrict local and privileged access on affected devices to reduce the population of principals able to stage a malicious firmware image

Patch Information

Qualcomm addressed CVE-2025-47382 in the December 2025 security bulletin. Downstream device manufacturers must integrate the fixed firmware into their OTA updates. Refer to the Qualcomm Security Bulletin December 2025 for the authoritative list of fixed components and coordinate with each OEM for delivery timelines.

Workarounds

Enforce verified boot and platform attestation on managed devices so that tampered firmware states are detected and quarantined
Limit administrative and developer-mode access on production devices to prevent local staging of crafted firmware images
Where supported, enable rollback protection and anti-rollback fuses to prevent downgrade to vulnerable firmware after patching

bash

# Example: verify device firmware build against a known-good baseline (Android)
adb shell getprop ro.build.fingerprint
adb shell getprop ro.boot.bootloader
adb shell getprop ro.boot.verifiedbootstate