CVE-2025-47377
Published: 02 March 2026
Summary
CVE-2025-47377 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-47377 is a memory corruption vulnerability stemming from access to a buffer after it has been freed (CWE-416) while processing IOCTL calls. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-02. The vulnerability affects components in Qualcomm products, as referenced in their security advisories.
A local attacker with low privileges can exploit this issue with low complexity and no user interaction required. By sending crafted IOCTL calls, the attacker triggers the use-after-free condition, enabling memory corruption that results in high impacts to confidentiality, integrity, and availability, such as potential arbitrary code execution within the affected process scope.
Qualcomm's March 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html details patches and mitigation guidance for affected products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208186
Vulnerability details
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free in IOCTL processing enables arbitrary code execution from low-privileged context, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in IOCTL processing by requiring timely application of Qualcomm patches from the March 2026 security bulletin.
Implements memory protection safeguards that prevent exploitation of the use-after-free condition for arbitrary code execution during IOCTL handling.
Validates IOCTL inputs to block crafted calls that trigger the buffer-after-free memory corruption.