CVE-2025-47388
Published: 07 January 2026
Summary
CVE-2025-47388 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Qualcomm Fastconnect 6200 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-47388 is a memory corruption vulnerability classified under CWE-120, triggered while passing pages to the DSP with an unaligned starting address. It affects Qualcomm products, as documented in their January 2026 security bulletin.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by a local attacker possessing low privileges. Exploitation requires low complexity and no user interaction, potentially resulting in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system compromise within the affected scope.
Mitigation details and patches are outlined in Qualcomm's security bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html, published on 2026-01-07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1263
Vulnerability details
Memory corruption while passing pages to DSP with an unaligned starting address.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption (CWE-120) enabling arbitrary code execution and system compromise maps directly to exploitation for privilege escalation on affected Qualcomm platforms.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements memory protection mechanisms to prevent exploitation of memory corruption from unaligned page addresses passed to the DSP.
Mandates timely flaw remediation via patches outlined in Qualcomm's security bulletin for this specific memory corruption vulnerability.
Requires validation of inputs such as page starting addresses to ensure alignment and avoid triggering the unaligned memory corruption condition.