CVE-2025-47408CWE-119CWE-822

CVE-2025-47408

High · published May 4, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

Memory corruption when another driver calls an IOCTL with invalid input/output buffer.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00075 · 0.1th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-822 · Untrusted Pointer Dereference
Published
2026-05-04T21:16Z
Affected products (20)
ProductVersionsFixed in
qualcomm/fastconnect_6200_firmwareall versions—
qualcomm/fastconnect_6900_firmwareall versions—
qualcomm/fastconnect_7800_firmwareall versions—
qualcomm/iqx5121_firmwareall versions—
qualcomm/iqx7181_firmwareall versions—
qualcomm/qca0000_firmwareall versions—
qualcomm/sc8380xp_firmwareall versions—
qualcomm/sd865_5g_firmwareall versions—
qualcomm/sm6250_firmwareall versions—
qualcomm/snapdragon_7c_compute_firmwareall versions—
qualcomm/snapdragon_7c_gen_2_compute_firmwareall versions—
qualcomm/snapdragon_xr2_5g_firmwareall versions—
qualcomm/snapdragon_xr2\+_gen_1_firmwareall versions—
qualcomm/wcd9380_firmwareall versions—
qualcomm/wcd9385_firmwareall versions—
qualcomm/wsa8810_firmwareall versions—
qualcomm/wsa8815_firmwareall versions—
qualcomm/wsa8840_firmwareall versions—
qualcomm/wsa8845_firmwareall versions—
qualcomm/wsa8845h_firmwareall versions—
References (1)
https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html · [email protected]
EPSS history
Timeline
  • 04 MAY 16:43Z
    Untrusted Pointer Dereference in Power Optimization Firmware
    cvelistv5