Cyber Resilience

CVE-2025-47397

Qualcomm Ar8031 Firmware

Published
02 February 2026
Modified
11 February 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.00092 0.6th percentile
Risk Priority 53 floored blend · peak EPSS

Summary

CVE-2025-47397 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Qualcomm Ar8031 Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-47397 is a memory corruption vulnerability that arises when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. It is associated with CWE-401 (Memory Leak) and affects components in Qualcomm products, as documented in their security advisories. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with significant impacts on confidentiality, integrity, and availability.

A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves triggering the faulty GPU memory mapping process, leading to memory corruption that could enable arbitrary code execution, data tampering, or system crashes within the affected scope.

The Qualcomm February 2026 security bulletin provides details on affected products and mitigation, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2026-bulletin.html. Security practitioners should consult this advisory for patch information and apply updates promptly to vulnerable devices.

EU & UK References

Vulnerability Data

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-33086Same product: Qualcomm Csra6620
CVE-2023-33084Same product: Qualcomm Fastconnect 6700
CVE-2023-33049Same product: Qualcomm Fastconnect 6200
CVE-2023-21666Same product: Qualcomm Qca6391
CVE-2025-47398Same product: Qualcomm Ar8031
CVE-2025-47371Same product: Qualcomm Csra6620
CVE-2025-47366Same product: Qualcomm Fastconnect 6200
CVE-2024-53024Same product: Qualcomm Csra6620
CVE-2026-24082Same product: Qualcomm Ar8031
CVE-2025-47391Same product: Qualcomm Fastconnect 6200

Affected Assets

qualcomm
ar8031 firmware
all versions
qualcomm
csra6620 firmware
all versions
qualcomm
csra6640 firmware
all versions
qualcomm
fastconnect 6200 firmware
all versions
qualcomm
fastconnect 6700 firmware
all versions
qualcomm
wcd9390 firmware
all versions
qualcomm
wcd9395 firmware
all versions
qualcomm
wcn3910 firmware
all versions
qualcomm
wcn3950 firmware
all versions
qualcomm
wcn3980 firmware
all versions
+137 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation (static analysis, fuzzing, or runtime leak detection) directly finds missing deallocation.

Requiring documented development standards and tools can mandate memory-management disciplines that avoid leaks at introduction.

Engineering principles applied during development can require explicit resource-release patterns that stop memory leaks from being coded.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce proper memory allocation/deallocation via coding standards, reviews, and tooling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect unreleased memory, providing partial coverage of the weakness.

prevents

Secure development life cycle mandates memory-management practices that reduce missing-release defects.

prevents

Application security requirements can specify explicit memory-release rules, partially mitigating the weakness.

prevents

Secure system architecture and engineering principles include resource-management guidelines that address memory leaks.

prevents

Secure coding standards directly require proper allocation/deallocation, covering most of this weakness.

finds

Capacity management may detect memory exhaustion symptoms but does not prevent the coding flaw.

References