CVE-2025-47368CWE-126

CVE-2025-47368

High · published November 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

⚡ A sneaky memory corruption lurks when processing MCDM IOCTL requests, ready for exploitation! Think of it like a chef trying to use a recipe with missing ingredients — they’re reaching into the pantry but grabbing a shelf that’s empty, causing a disastrous outcome in the kitchen. This vulnerability allows the system to get lost in its own data, leading to unpredictable results. If exploited, an attacker could leverage this flaw to cause crashes, potentially escalating privileges and gaining access to sensitive information. The fallout could be absolutely devastating, leaving systems unstable and users vulnerable!

Put simply

Think of it like a chef trying to use a recipe with missing ingredients — they’re reaching into the pantry but grabbing a shelf that’s empty, causing a disastrous outcome in the kitchen. This vulnerability allows the system to get lost in its own data, leading to unpredictable results. This vulnerability occurs when the system dereferences an invalid userspace address in a user buffer during MCDM IOCTL processing, leading to memory corruption issues that could be exploited by an attacker.

What to do

If exploited, an attacker could leverage this flaw to cause crashes, potentially escalating privileges and gaining access to sensitive information. The fallout could be absolutely devastating, leaving systems unstable and users vulnerable! To mitigate this risk, update the affected systems as soon as patches are available, and ensure that proper validation checks are implemented for all user inputs. Regularly audit your kernel modules to prevent similar vulnerabilities in the future. You've got this! Stay proactive, and your systems will be fortified in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00087 · 0.3th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2025-11-04T09:15Z
Affected products (8)
ProductVersionsFixed in
qualcomm/fastconnect_6900_firmwareall versions—
qualcomm/fastconnect_7800_firmwareall versions—
qualcomm/sc8380xp_firmwareall versions—
qualcomm/wcd9380_firmwareall versions—
qualcomm/wcd9385_firmwareall versions—
qualcomm/wsa8840_firmwareall versions—
qualcomm/wsa8845_firmwareall versions—
qualcomm/wsa8845h_firmwareall versions—
References (1)
EPSS history
Timeline
  • 04 NOV 03:19Z
    Buffer Over-read in DSP Service
    cvelistv5