Cyber Posture

CVE-2025-47376

High

Published: 02 March 2026

Published
02 March 2026
Modified
04 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 4.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47376 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Ar8031 Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Implements memory protection mechanisms such as address space layout randomization and data execution prevention that directly mitigate use-after-free vulnerabilities from concurrent access to shared buffers during IOCTL calls.

prevent

Prevents unauthorized and unintended information transfer or modification via shared system resources like buffers used in IOCTL operations, addressing concurrent access race conditions.

prevent

Mandates timely flaw remediation through application of Qualcomm's vendor-specific patches for this memory corruption vulnerability as detailed in their security bulletin.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local UAF in Qualcomm IOCTL driver directly provides arbitrary kernel code execution from low-privileged user context, enabling privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

Deeper analysisAI

CVE-2025-47376 is a memory corruption vulnerability caused by concurrent access to a shared buffer during IOCTL calls, classified under CWE-416 (Use After Free). It affects Qualcomm components, as detailed in the vendor's security bulletin.

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by a local attacker with low privileges and low complexity, requiring no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling arbitrary code execution or system crashes through manipulated IOCTL operations.

Qualcomm's March 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html provides details on affected products and recommended mitigations or patches. Security practitioners should consult this advisory for version-specific remediation steps.

Details

CWE(s)

Affected Products

qualcomm
ar8031 firmware
all versions
qualcomm
ar8035 firmware
all versions
qualcomm
csra6620 firmware
all versions
qualcomm
csra6640 firmware
all versions
qualcomm
fastconnect 6200 firmware
all versions
qualcomm
fastconnect 6700 firmware
all versions
qualcomm
fastconnect 6800 firmware
all versions
qualcomm
fastconnect 6900 firmware
all versions
qualcomm
fastconnect 7800 firmware
all versions
qualcomm
flight rb5 5g platform firmware
all versions
+160 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-47386Same product: Qualcomm Ar8031
CVE-2025-47375Same product: Qualcomm Ar8031
CVE-2025-47379Same product: Qualcomm Ar8031
CVE-2025-47377Same product: Qualcomm Ar8035
CVE-2026-24082Same product: Qualcomm Ar8031
CVE-2025-47398Same product: Qualcomm Ar8031
CVE-2025-21424Same product: Qualcomm Ar8031
CVE-2024-53023Same product: Qualcomm Ar8035
CVE-2025-47339Same product: Qualcomm Ar8035
CVE-2025-47381Same product: Qualcomm Lemans Au Lgit

References