CVE-2025-47374

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-47374", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "dateReserved": "2025-05-06T08:33:16.265Z", "datePublished": "2026-04-06T15:33:39.322Z", "dateUpdated": "2026-04-06T16:32:18.294Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon CCW", "Snapdragon Compute"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "FastConnect 6900"}, {"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "Pandeiro"}, {"status": "affected", "version": "QLN1083BD"}, {"status": "affected", "version": "QLN1086BD"}, {"status": "affected", "version": "QPA1083BD"}, {"status": "affected", "version": "QPA1086BD"}, {"status": "affected", "version": "QXM1083"}, {"status": "affected", "version": "QXM1086"}, {"status": "affected", "version": "QXM1093"}, {"status": "affected", "version": "QXM1094"}, {"status": "affected", "version": "QXM1095"}, {"status": "affected", "version": "QXM1096"}, {"status": "affected", "version": "SAR1165P"}, {"status": "affected", "version": "SAR2130P"}, {"status": "affected", "version": "Snapdragon AR1 Gen 1 Platform"}, {"status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform"}, {"status": "affected", "version": "SXR2230P"}, {"status": "affected", "version": "SXR2250P"}, {"status": "affected", "version": "SXR2330P"}, {"status": "affected", "version": "SXR2350P"}, {"status": "affected", "version": "WCD9380"}, {"status": "affected", "version": "WCD9385"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "XRV7209"}, {"status": "affected", "version": "XRV9209"}]}], "descriptions": [{"lang": "en", "value": "Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2026-04-06T15:33:39.322Z"}, "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html"}], "title": "Use After Free in Camera Driver"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T16:11:13.925807Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:32:18.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T16:11:13.925807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:22:45.822Z"}}], "cna": {"title": "Use After Free in Camera Driver", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "FastConnect 6900"}, {"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "Pandeiro"}, {"status": "affected", "version": "QLN1083BD"}, {"status": "affected", "version": "QLN1086BD"}, {"status": "affected", "version": "QPA1083BD"}, {"status": "affected", "version": "QPA1086BD"}, {"status": "affected", "version": "QXM1083"}, {"status": "affected", "version": "QXM1086"}, {"status": "affected", "version": "QXM1093"}, {"status": "affected", "version": "QXM1094"}, {"status": "affected", "version": "QXM1095"}, {"status": "affected", "version": "QXM1096"}, {"status": "affected", "version": "SAR1165P"}, {"status": "affected", "version": "SAR2130P"}, {"status": "affected", "version": "Snapdragon AR1 Gen 1 Platform"}, {"status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform"}, {"status": "affected", "version": "SXR2230P"}, {"status": "affected", "version": "SXR2250P"}, {"status": "affected", "version": "SXR2330P"}, {"status": "affected", "version": "SXR2350P"}, {"status": "affected", "version": "WCD9380"}, {"status": "affected", "version": "WCD9385"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "XRV7209"}, {"status": "affected", "version": "XRV9209"}], "platforms": ["Snapdragon CCW", "Snapdragon Compute"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html"}], "descriptions": [{"lang": "en", "value": "Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2026-04-06T15:33:39.322Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47374", "state": "PUBLISHED", "dateUpdated": "2026-04-06T16:32:18.294Z", "dateReserved": "2025-05-06T08:33:16.265Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2026-04-06T15:33:39.322Z", "assignerShortName": "qualcomm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon CCW", "Snapdragon Compute"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "FastConnect 6900"}, {"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "Pandeiro"}, {"status": "affected", "version": "QLN1083BD"}, {"status": "affected", "version": "QLN1086BD"}, {"status": "affected", "version": "QPA1083BD"}, {"status": "affected", "version": "QPA1086BD"}, {"status": "affected", "version": "QXM1083"}, {"status": "affected", "version": "QXM1086"}, {"status": "affected", "version": "QXM1093"}, {"status": "affected", "version": "QXM1094"}, {"status": "affected", "version": "QXM1095"}, {"status": "affected", "version": "QXM1096"}, {"status": "affected", "version": "SAR1165P"}, {"status": "affected", "version": "SAR2130P"}, {"status": "affected", "version": "Snapdragon AR1 Gen 1 Platform"}, {"status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform"}, {"status": "affected", "version": "SXR2230P"}, {"status": "affected", "version": "SXR2250P"}, {"status": "affected", "version": "SXR2330P"}, {"status": "affected", "version": "SXR2350P"}, {"status": "affected", "version": "WCD9380"}, {"status": "affected", "version": "WCD9385"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "XRV7209"}, {"status": "affected", "version": "XRV9209"}]}], "source": "product-security@qualcomm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E670F500-9B71-4BBE-B5DA-221D35803C89", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*", "matchCriteriaId": "9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*", "matchCriteriaId": "638DBC7F-456F-487D-BED2-2214DFF8BEE2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "23F8EF0C-BB48-47E1-A045-254D79388F75", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*", "matchCriteriaId": "058950FC-ED72-4E91-AE13-87E738ADC083", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FD70F234-1EE7-4362-97F6-5AEDB7078D03", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*", "matchCriteriaId": "C569A848-B70C-42EF-B6D5-4A86547586EE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F218DF06-C40A-4738-ABB5-A3FA2243EF84", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E2A0CD0-66FA-45D6-BBC7-03641203EC73", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0208F7B-A959-485E-B004-A34CB7C7C4C9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*", "matchCriteriaId": "FBDAC812-4603-4D24-A861-23825E32D44E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*", "matchCriteriaId": "00EF6875-B088-40BD-A526-C962789CDC5A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "0CE74B89-5E3F-428E-8000-E3452B8B6953", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC11B7A6-E621-463D-B861-6B203EADFA57", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E48759CC-B751-4466-87DF-2D0AB220C0FB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A46B609-BD06-4BB7-B055-1F71C555E93D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*", "matchCriteriaId": "59598462-1E53-4F6D-BAB5-06ACEDF6CD9F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8F30D66E-2802-4394-BC39-5E04711234FF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*", "matchCriteriaId": "078EC383-784F-4468-B94C-AE7CC9808419", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7B67C93-0453-4696-8F3D-0AD664922C44", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*", "matchCriteriaId": "D61C46AA-9130-46A8-BD04-8B4235118B81", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E2D5E44-48F6-41E8-A38B-A2E070E16AA9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BD0372F-5140-4966-9A27-6B5A606C0665", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "9D97CD52-4CB0-4F57-9C24-530B326B8D9D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*", "matchCriteriaId": "582EE932-DDE5-4BE5-837C-523FE3EFBA5D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "95696696-D2AE-4358-AF5D-3ED14F969964", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A6FC469-463F-4EC1-B4EF-010BDB9BAA05", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*", "matchCriteriaId": "0BB2408F-C768-4DD2-B834-B62E188D6CC2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "BE30A5E0-10D5-4679-ACA6-4ED991335A6F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFA75B74-D20D-4C8B-BFA2-5DE4848410CD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD6444F6-A477-4B4C-8A09-C22C47CCE45B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*", "matchCriteriaId": "F3E20681-4FC4-46E2-AF77-BCF03BC8E77E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "68A93ED1-F509-439E-AE7B-F0EC87AE759F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*", "matchCriteriaId": "FB5E2A98-EDD0-4298-911D-EC7527D5A424", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "568C5B08-AC42-48D3-8029-A65689EEBE75", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:*", "matchCriteriaId": "56DD2B49-0A36-443C-BECB-4115E271A415", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sxr2350p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AA54D269-A94D-47CB-B3F1-7B163E453A67", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sxr2350p:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1D79422-1EA3-459A-8C4A-8A0FBE386036", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "70292B01-617F-44AD-AF77-1AFC1450523D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*", "matchCriteriaId": "FA94C6D6-85DB-4031-AAF4-C399019AE16D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "92B17201-8185-47F1-9720-5AB4ECD11B22", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*", "matchCriteriaId": "E1FA2EB9-416F-4D69-8786-386CC73978AE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2EB8794F-7998-424E-AF68-E4A4F9310F65", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*", "matchCriteriaId": "799D69CE-3FCC-4B19-8B00-9AF38111D983", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "57608D47-894C-4895-B4B3-4733D55D57DB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*", "matchCriteriaId": "2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "11B69595-E488-4590-A150-CE5BE08B5E13", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF680174-5FA6-47D9-8EAB-CC2A37A7BD42", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "7ACAD26E-B79E-4659-91A5-D301281F7D36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*", "matchCriteriaId": "F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F80BC68E-7476-4A40-9F48-53722FE9A5BF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*", "matchCriteriaId": "6B36F4B2-BAA3-45AD-9967-0EB482C99708", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "CC6C6243-E092-4903-BC20-E3B0CECBC790", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*", "matchCriteriaId": "AAA33761-D61C-4A81-B233-5E2D50F3596F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D693483-72F9-42B1-8EDA-8DABD537F428", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*", "matchCriteriaId": "43F4A7D9-055D-475B-BFE4-61A86C7397F8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling."}, {"lang": "es", "value": "Corrupci\u00f3n de memoria al acceder a memoria liberada debido a la anulaci\u00f3n de registro de valla concurrente y el manejo de se\u00f1ales."}], "id": "CVE-2025-47374", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.5, "source": "product-security@qualcomm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47374", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T16:11:13.925807Z", "version": "2.0.3"}}]}, "published": "2026-04-06T16:16:27.177", "references": [{"source": "product-security@qualcomm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html"}], "sourceIdentifier": "product-security@qualcomm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "product-security@qualcomm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "FastConnect 6900"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "FastConnect 7800"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "Pandeiro"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QLN1083BD"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QLN1086BD"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QPA1083BD"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QPA1086BD"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1083"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1086"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1093"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1094"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1095"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "QXM1096"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SAR1165P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SAR2130P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "Snapdragon AR1 Gen 1 Platform"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "Snapdragon AR1+ Gen 1 Platform"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SXR2230P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SXR2250P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SXR2330P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "SXR2350P"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WCD9380"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WCD9385"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WCN7860"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WCN7861"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WSA8830"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WSA8832"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "WSA8835"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "XRV7209"}}, {"platform": ["snapdragon_ccw", "snapdragon_compute"], "status": "affected", "versions": {"scheme": "generic", "value": "XRV9209"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Snapdragon", "source": "cna", "vendor": "Qualcomm, Inc."}, "product": "snapdragon", "vendor": "qualcomm"}], "analysis": {"en": {"generated_at": "2026-04-08T23:07:23.376638+00:00", "value": {"mitigation_remediation": ["Apply the Qualcomm firmware update referenced in the April\u00a02026 security bulletin.", "Verify that the device firmware version matches the patched release listed in the bulletin.", "If a firmware update is not yet available, restrict camera driver usage by disabling related services or applications.", "Monitor device logs for signs of memory corruption or abnormal crashes related to camera activity."], "summary": {"action": "Immediate Patch", "impact": "Use after free leading to memory corruption in Qualcomm camera driver"}, "threat_synthesis": {"affected_systems": "Qualcomm Snapdragon devices and associated firmware are affected. The issue spans a range of hardware, including Snapdragon AR1 Gen\u00a01 platforms, Snapdragon XR series (SXR2230p, SXR2250p, SXR2330p, SXR2350p), various Wi\u2011Fi and Bluetooth modules (WCD9380, WCD9385, WCN7860, WCN7861), and modem components (FastConnect\u00a06900/7800, Pandeiro, QLN1083BD/1086BD, QPA1083BD/1086BD, QXM1083/1086/1093/1094/1095/1096, SAR1165P, SAR2130P). Firmware versions are not specified in the advisory, so any firmware containing the vulnerable camera driver code is potentially impacted.", "description_and_impact": "The vulnerability arises from memory corruption when the camera driver accesses freed memory during concurrent fence deregistration and signal handling. This results in a use\u2011after\u2011free condition (CWE\u2011416). The primary impact is the potential alteration of memory contents, which could undermine the integrity of the device and, if exploited, could lead to denial of service or escalation of privileges within the firmware context.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the near term. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is inferred to be device\u2011local, potentially triggered when the camera subsystem registers or deregisters fences concurrently with signal handling; an attacker would need to drive the camera driver into this race condition to exploit the use\u2011after\u2011free."}}}}, "created": "2026-04-06T20:14:01.731961+00:00", "updated": "2026-04-09T08:29:02.907769+00:00", "vendors": ["qualcomm", "qualcomm$PRODUCT$snapdragon"]}