CVE-2025-47408
Published: 04 May 2026
Summary
CVE-2025-47408 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Qualcomm Fastconnect 6200 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of IOCTL input/output buffers to prevent untrusted pointer dereferences causing memory corruption.
Implements memory safeguards such as address space randomization and data execution prevention to protect against memory corruption from invalid buffer handling.
Mandates timely remediation of the specific flaw via patches from Qualcomm's security bulletin to eliminate the memory corruption vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption in Qualcomm driver via invalid IOCTL enables privilege escalation from low-privileged context.
NVD Description
Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
Deeper analysisAI
CVE-2025-47408 is a memory corruption vulnerability (CWE-822: Untrusted Pointer Dereference) triggered when another driver issues an IOCTL call with invalid input or output buffers. It affects components in Qualcomm products, as documented in the vendor's security bulletin.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by a local attacker with low privileges. Exploitation requires low complexity and no user interaction, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability through memory corruption.
Qualcomm's May 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html provides details on affected products and recommended mitigations or patches.
Details
- CWE(s)