CVE-2025-47394: Qualcomm Fastconnect Buffer Overflow Flaw

CVE-2025-47394 Overview

CVE-2025-47394 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware, including Snapdragon mobile platforms, FastConnect connectivity modules, and audio codec components. The flaw stems from incorrect offset calculations when copying overlapping buffers during memory operations, classified under [CWE-120] Buffer Copy without Checking Size of Input. A local attacker with low privileges can trigger the condition to compromise confidentiality, integrity, and availability on affected devices. Qualcomm addressed the issue in its January 2026 security bulletin.

Critical Impact
Local low-privileged attackers can corrupt memory on Qualcomm-based devices, potentially achieving code execution or full compromise of firmware components handling wireless, audio, and platform operations.

Affected Products

Qualcomm FastConnect 6200, 6700, 6900, and 7800 firmware
Qualcomm Snapdragon 4 Gen 2, Snapdragon 6 Gen 1, and Snapdragon W5+ Gen 1 Wearable Platform firmware
Qualcomm WCD, WCN, WSA, SM, SXR, and QCS series firmware components

Discovery Timeline

2026-01-07 - CVE-2025-47394 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47394

Vulnerability Analysis

The vulnerability resides in firmware routines that perform memory copy operations between buffers that may overlap in address space. When source and destination regions overlap, correct handling requires the code to compute offsets carefully or use overlap-safe primitives such as memmove. The affected Qualcomm firmware components calculate these offsets incorrectly, causing data to be read from or written to unintended memory regions. This produces memory corruption that can be leveraged to alter firmware state, overwrite adjacent structures, or hijack control flow inside privileged firmware contexts.

Exploitation requires local access with low privileges and no user interaction, but yields high impact across confidentiality, integrity, and availability. Because the affected components include wireless connectivity, audio codec, and mobile platform firmware, a successful compromise can cross trust boundaries between userland processes and firmware-resident logic.

Root Cause

The root cause is an arithmetic error in offset calculation during buffer copy operations where source and destination ranges overlap. Instead of adjusting the copy direction or using an overlap-aware routine, the code performs the copy with incorrect indices, corrupting memory bytes that fall outside the intended destination range. This aligns with [CWE-120], where insufficient validation of size and layout leads to out-of-bounds writes.

Attack Vector

The attack vector is local. An attacker with low-privileged code execution on the device, for example a malicious or compromised application, can invoke the affected firmware pathway with crafted parameters that force overlapping buffer copies. See the Qualcomm January 2026 Security Bulletin for vendor-specific technical details.

// No public proof-of-concept is available. See Qualcomm's advisory for details.

Detection Methods for CVE-2025-47394

Indicators of Compromise

Unexpected crashes, reboots, or kernel panics in Qualcomm firmware subsystems such as WLAN, audio codec, or modem services
Anomalous crash dumps referencing memory copy routines in affected firmware modules
Unauthorized applications requesting elevated access to Qualcomm HAL or firmware interfaces

Detection Strategies

Inventory devices against the affected chipset list from the Qualcomm January 2026 Security Bulletin and flag unpatched firmware builds
Monitor mobile device management (MDM) telemetry for patch level and firmware version drift across the fleet
Correlate application behavior logs against known-good baselines to identify apps invoking low-level firmware IOCTLs

Monitoring Recommendations

Track Android security patch levels and OEM firmware release notes to confirm delivery of the January 2026 Qualcomm fixes
Alert on repeated Qualcomm subsystem crashes reported through vendor crash telemetry
Restrict installation of untrusted third-party applications on devices operating in sensitive environments

How to Mitigate CVE-2025-47394

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm January 2026 Security Bulletin as OEMs release them
Coordinate with device OEMs and carriers to confirm patch availability for each affected chipset in your fleet
Enforce MDM policies that require the latest OEM security patch level before granting access to corporate resources

Patch Information

Qualcomm has published fixes for CVE-2025-47394 in the January 2026 security bulletin. Patch delivery depends on downstream OEMs incorporating Qualcomm's updated firmware into device-level security releases. Administrators should verify vendor-specific patch identifiers against each affected component listed in the advisory.

Workarounds

Limit installation of untrusted applications that could execute local code on affected devices
Restrict sideloading and enforce application allowlisting via MDM controls
Segment sensitive devices onto isolated networks until firmware patches are applied

bash

# Verify Android security patch level on managed devices
adb shell getprop ro.build.version.security_patch