CVE-2025-47346
Published: 07 January 2026
Summary
CVE-2025-47346 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Qualcomm Sa8145P Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Implements memory protection mechanisms such as address space layout randomization and stack guards to directly prevent exploitation of out-of-bounds write vulnerabilities like CVE-2025-47346.
Requires validation of inputs to the secure logging command processing in the trusted application to block malformed data causing memory corruption.
Mandates timely flaw remediation through patching of the memory corruption vulnerability in Qualcomm trusted applications as detailed in their security bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption (out-of-bounds write) in trusted application directly enables privilege escalation from low-privileged local context to arbitrary code execution and full control within the TEE.
NVD Description
Memory corruption while processing a secure logging command in the trusted application.
Deeper analysisAI
CVE-2025-47346 is a memory corruption vulnerability, classified under CWE-787 (Out-of-bounds Write), that occurs while processing a secure logging command in the trusted application. It was published on 2026-01-07 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to significant impacts on confidentiality, integrity, and availability. The vulnerability affects components in Qualcomm products, as referenced in their security documentation.
A local attacker with low privileges can exploit this issue through low-complexity attacks requiring no user interaction. Exploitation targets the trusted application during secure logging command processing, potentially enabling full control over the affected component, including arbitrary code execution, data tampering, or denial of service within the trusted execution environment.
Qualcomm's January 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html provides details on affected products and recommended mitigations or patches.
Details
- CWE(s)