CVE Alert: CVE-2025-47349 – Qualcomm, Inc. – Snapdragon

Risk verdict

High-severity, local memory-corruption risk in the DSP service could enable full device compromise if exploited; no active exploitation reported at this time.

Why this matters

Affects multiple Snapdragon components across mobile and embedded devices, meaning a broad fleet could be exposed. With local access and no user interaction required, an attacker could exfiltrate data, alter integrity, or cause denial of service on a targeted device. The combination of high confidentiality, integrity and availability impact makes timely remediation important, even if current exploitation is not observed.

Most likely attack path

Prerequisites are minimal but real: the attacker must have local access and operate with low privileges, no user interaction required. Exploiting an out-of-range pointer in the DSP path could trigger a memory corruption event, potentially enabling broader compromise within the device. Lateral movement is unlikely across devices due to the local-vector constraint, but any successful exploitation could enable post-compromise actions on the host.

Who is most exposed

Fleet deployments that rely on Qualcomm Snapdragon hardware—smartphones, wearables, and embedded IoT/vehicle systems—are most at risk, especially where DSP services are exposed to applications or untrusted components.

Detection ideas

• DSP service crash dumps or kernel logs indicating memory corruption
• Unusual or repeated memory access errors in DSP-related processes
• Segmentation faults or stack traces pointing to DSP memory handling
• Anomalous device reboots or stability events tied to DSP activity
• Local privilege escalation attempts reported by device security tooling

Mitigation and prioritisation

• Apply vendor patch or firmware update as soon as provided; monitor the October 2025 bulletin for mitigations.
• Restrict DSP service exposure to trusted components and enforce strict application sandboxing.
• Strengthen memory protections (ASLR/DEP), and implement least-privilege access for apps interfacing with DSP services.
• Validate change-management: test the patch in a controlled pilot before fleet-wide rollout.
• If KEV is confirmed or EPSS ≥ 0.5, treat as priority 1; otherwise escalate to high-priority patching and monitoring.