CVE-2025-47393
Published: 07 January 2026
Summary
CVE-2025-47393 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Qualcomm Qam8255P Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-47393 is a memory corruption vulnerability stemming from improper validation of array index (CWE-129) that occurs when accessing resources in a kernel driver. It affects components in Qualcomm products, as documented in the vendor's January 2026 security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing the attacker to gain elevated control over the affected system through kernel-level memory corruption.
Qualcomm's security advisory at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html provides details on mitigation, including available patches for affected products. Security practitioners should consult this bulletin for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1248
Vulnerability details
Memory corruption when accessing resources in kernel driver.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel memory corruption in driver (CWE-129) directly enables local privilege escalation from low-priv user to kernel-level control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely identification, reporting, and patching of the specific kernel driver memory corruption flaw.
Addresses the root cause of improper array index validation (CWE-129) by enforcing validation of inputs to kernel drivers.
Provides comprehensive memory safeguards such as ASLR and DEP to protect against exploitation of kernel memory corruption.