CVE-2025-47399
Published: 02 February 2026
Summary
CVE-2025-47399 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Qualcomm Cologne Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of invalid input parameters to IOCTL calls for sensor property updates, preventing memory corruption.
Implements runtime memory protections such as address space layout randomization and data execution prevention to mitigate exploitation of memory corruption vulnerabilities.
Requires timely application of vendor patches for the specific Qualcomm sensor IOCTL flaw, eliminating the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption in IOCTL handler directly enables kernel-level exploitation for privilege escalation and arbitrary code execution.
NVD Description
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.
Deeper analysisAI
CVE-2025-47399 is a memory corruption vulnerability, classified under CWE-120, that occurs while processing an IOCTL call to update sensor property settings with invalid input parameters. It affects Qualcomm software components, particularly those handling sensor-related operations.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it through low-complexity means without requiring user interaction, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or system compromise.
Qualcomm's February 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2026-bulletin.html provides details on affected products and mitigation measures, including available patches.
Details
- CWE(s)