CVE-2025-47398
Published: 02 February 2026
Summary
CVE-2025-47398 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Qcm6490 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-51 (Hardware-based Protection) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free memory corruption vulnerability by requiring timely application of Qualcomm-provided patches.
Implements runtime memory safeguards such as address space layout randomization and data execution prevention to block exploitation of improper GPU memory pointer handling.
Uses hardware-based protections like memory tagging and pointer authentication to detect and prevent memory corruption during GPU buffer deallocation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free memory corruption in GPU driver directly enables privilege escalation via crafted deallocation of buffers.
NVD Description
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
Deeper analysisAI
CVE-2025-47398 is a memory corruption vulnerability that occurs while deallocating graphics processing unit (GPU) memory buffers due to improper handling of memory pointers. It is classified under CWE-416 (Use After Free) and affects Qualcomm products, as documented in their security bulletin. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) when published on 2026-02-02.
The vulnerability can be exploited by a local attacker with low privileges, requiring low complexity and no user interaction. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data (confidentiality), modification of system resources (integrity), and disruption of services (availability).
Qualcomm's February 2026 Security Bulletin provides details on mitigations and patches; practitioners should consult the advisory at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2026-bulletin.html for specific remediation steps.
Details
- CWE(s)