PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-47388 Qualcomm, Inc. CVE debrief

CVE-2025-47388 is a high-severity vulnerability affecting multiple Qualcomm chipsets, including FastConnect, QCS610, and QMP1000. The vulnerability occurs when passing pages to DSP with an unaligned starting address, potentially causing memory corruption. This could lead to system instability, denial-of-service (DoS) conditions, or unauthorized access. Device manufacturers and users should prioritize patching to prevent potential system instability. Qualcomm has provided patches for affected devices, which should be applied as soon as possible.

Vendor
Qualcomm, Inc.
Product
Snapdragon
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-07
Original CVE updated
2026-09-30
Advisory published
2026-01-07
Advisory updated
2026-09-30

Who should care

Qualcomm device manufacturers, users, security teams responsible for patching and vulnerability management, and operators of affected platforms should prioritize patching vulnerable devices to prevent potential system instability, DoS conditions, or unauthorized access. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and checking relevant monitoring, and

Why it matters

CVE-2025-47388 is a high-severity vulnerability in multiple Qualcomm chipsets that could lead to memory corruption. Device manufacturers and users should prioritize patching to prevent potential system instability, DoS conditions, or unauthorized access.

  • Memory corruption could lead to system crashes or instability
  • Potential for denial-of-service (DoS) conditions
  • Possible elevation of privileges or unauthorized access
  • Requires verification of affected versions and patch application

Technical summary

The vulnerability occurs when passing pages to DSP with an unaligned starting address, potentially causing memory corruption. Multiple Qualcomm chipsets are affected, including FastConnect, QCS610, QMP1000, and others. The vulnerability could lead to system crashes or instability, denial-of-service (DoS) conditions, or possible elevation of privileges or unauthorized access. Affected device manufacturers and users should verify affected versions and apply patches from Qualcomm.

Defensive priority

Qualcomm device manufacturers and users should prioritize patching vulnerable devices.

Recommended defensive actions

  • Apply patches from Qualcomm for affected devices
  • Inventory and assess Qualcomm device deployments for vulnerable chipsets
  • Monitor for indicators of compromise related to this vulnerability

Evidence notes

The CVE record and NVD detail page provide official information on the vulnerability. Qualcomm's security bulletin for January 2026 also addresses this issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-47388 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-47388

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-47388 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-47388

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html

    [email protected] - Patch, Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.