CVE-2025-47375
Published: 02 March 2026
Summary
CVE-2025-47375 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Qcm4325 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-51 (Hardware-based Protection) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-47375 is a memory corruption vulnerability classified under CWE-416 (Use After Free), triggered by simultaneous handling of different IOCTL calls from user-space. It carries a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability affects Qualcomm products, as documented in their March 2026 security bulletin.
A local attacker with low privileges can exploit this issue with low complexity and no user interaction required. Successful exploitation enables high-impact outcomes, including unauthorized data access, modification of system integrity, and denial of service through full confidentiality, integrity, and availability compromise, potentially leading to arbitrary code execution or privilege escalation within the affected component.
The Qualcomm March 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html details affected products, patch availability, and recommended mitigations for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208184
Vulnerability details
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free memory corruption in Qualcomm IOCTL handling directly enables local exploitation for privilege escalation and arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the Use After Free memory corruption in Qualcomm IOCTL handling by identifying, prioritizing, and applying vendor-specific patches from the March 2026 security bulletin.
Implements memory protection mechanisms like ASLR, DEP, and stack canaries to comprehensively prevent exploitation of the concurrent IOCTL-triggered Use After Free vulnerability.
Employs hardware-based protections such as memory isolation and trusted execution environments to block unauthorized code execution from the kernel memory corruption during simultaneous IOCTL processing.