CVE-2025-47343
Published: 07 January 2026
Summary
CVE-2025-47343 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Qualcomm Video Collaboration Vc3 Platform Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely application of vendor-supplied patches for the memory corruption issue in Qualcomm video parameter processing.
Implements runtime memory protections such as address space layout randomization and data execution prevention to counter untrusted pointer dereference exploits.
Validates video session parameters as inputs to prevent processing untrusted data leading to pointer dereference and memory corruption.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption vulnerability with low privileges enables direct exploitation for privilege escalation to achieve high impact on confidentiality, integrity, and availability.
NVD Description
Memory corruption while processing a video session to set video parameters.
Deeper analysisAI
CVE-2025-47343 is a memory corruption vulnerability stemming from CWE-822 (Untrusted Pointer Dereference) that occurs while processing a video session to set video parameters. It affects Qualcomm components, as detailed in the vendor's January 2026 security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential with local access vector, low attack complexity, and low privileges required.
A local attacker with low privileges can exploit this vulnerability without user interaction by triggering the faulty video parameter processing. Successful exploitation enables high-impact outcomes, including unauthorized access to sensitive data (confidentiality), modification of system state (integrity), and denial of service or system crashes (availability), potentially leading to full local privilege escalation or compromise of the affected component.
Qualcomm's January 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html provides details on affected products and recommends applying vendor-supplied patches to mitigate the issue. Practitioners should review the bulletin for specific firmware or driver updates tailored to impacted Snapdragon platforms or multimedia subsystems.
Details
- CWE(s)