CVE-2025-47339
Published: 07 January 2026
Summary
CVE-2025-47339 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Fastconnect 6900 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-47339 is a memory corruption vulnerability, classified under CWE-416 (Use After Free), that occurs during the deinitialization of a HDCP (High-bandwidth Digital Content Protection) session. It affects components in Qualcomm products, as detailed in the vendor's security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.8, reflecting high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized access to confidential data, modification of system integrity, and disruption of availability, potentially leading to arbitrary code execution within the affected component's context.
Qualcomm's January 2026 security bulletin provides details on the vulnerability, including affected products and recommended mitigations or patches; practitioners should consult https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1243
Vulnerability details
Memory corruption while deinitializing a HDCP session.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free memory corruption enabling arbitrary code execution from low privileges directly matches exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely flaw remediation by applying Qualcomm's patch for this specific Use After Free vulnerability in HDCP deinitialization.
SI-16 implements memory protection mechanisms that directly counter Use After Free memory corruption like in this CVE.
SC-39 process isolation confines arbitrary code execution to the affected HDCP component's context, limiting impact.