CVE-2025-47373
Published: 02 March 2026
Summary
CVE-2025-47373 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Qualcomm Fastconnect 7800 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates buffer lengths during TA invocation to prevent out-of-bounds writes from invalid inputs.
Implements memory protection mechanisms to guard against memory corruption exploits like CWE-787 out-of-bounds writes.
Ensures timely application of Qualcomm patches to remediate the specific memory corruption flaw in affected products.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds write memory corruption in TA invocation directly enables privilege escalation via exploitation of the vulnerability.
NVD Description
Memory Corruption when accessing buffers with invalid length during TA invocation.
Deeper analysisAI
CVE-2025-47373 is a memory corruption vulnerability classified under CWE-787 (Out-of-bounds Write), triggered by accessing buffers with invalid length during Trusted Application (TA) invocation. It was published on 2026-03-02 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects components in Qualcomm products, as referenced in their security documentation.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables high impacts on confidentiality, integrity, and availability, potentially allowing the attacker to compromise affected systems through memory corruption.
Qualcomm's March 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html details the affected products and provides guidance on mitigations or patches.
Details
- CWE(s)