CVE-2025-47380CWE-822

CVE-2025-47380

High · published January 7, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.2
In the wild
Unconfirmed
What it is

⚡ A memory corruption issue arises during preprocessing IOCTLs in sensors, and it’s like a kitchen where a chef accidentally mixes ingredients in the wrong order! Just imagine a chef trying to prepare a complex dish but using spoiled ingredients because the pantry wasn’t correctly organized. In this case, the sensors are like those ingredients, and if they are mishandled, the entire dish can turn out disastrous! An attacker could exploit this flaw to cause unpredictable behavior in the system, potentially leading to crashes or even remote code execution under specific circumstances. Depending on the system's role, this could result in a compromised network environment, exposing sensitive data or allowing unauthorized user actions.

Put simply

Just imagine a chef trying to prepare a complex dish but using spoiled ingredients because the pantry wasn’t correctly organized. In this case, the sensors are like those ingredients, and if they are mishandled, the entire dish can turn out disastrous! This vulnerability involves memory corruption due to improper handling of IOCTL requests in sensor drivers, leading to potential system instability and exploitation opportunities if an attacker can send crafted requests to the affected drivers.

What to do

An attacker could exploit this flaw to cause unpredictable behavior in the system, potentially leading to crashes or even remote code execution under specific circumstances. Depending on the system's role, this could result in a compromised network environment, exposing sensitive data or allowing unauthorized user actions. To mitigate this risk, ensure you update to the latest version of the affected drivers and review your system's configurations to minimize access to these IOCTLs. Regularly monitoring logs for unusual activities can also help detect potential exploitation attempts early. You've got this! By taking these steps, you’ll be well on your way to securing your systems and protecting your data! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00081 · 0.2th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-01-07T17:17Z
Affected products (14)
ProductVersionsFixed in
qualcomm/wsa8845h_firmwareall versions—
qualcomm/x2000077_firmwareall versions—
qualcomm/x2000086_firmwareall versions—
qualcomm/x2000090_firmwareall versions—
qualcomm/x2000092_firmwareall versions—
qualcomm/x2000094_firmwareall versions—
qualcomm/xg101002_firmwareall versions—
qualcomm/xg101032_firmwareall versions—
qualcomm/xg101039_firmwareall versions—
qualcomm/fastconnect_7800_firmwareall versions—
qualcomm/qcc2072_firmwareall versions—
qualcomm/wcd9378c_firmwareall versions—
qualcomm/wsa8840_firmwareall versions—
qualcomm/wsa8845_firmwareall versions—
References (1)
EPSS history
Timeline
  • 06 JAN 22:48Z
    Untrusted Pointer Dereference in Camera
    cvelistv5