CVE-2025-47373

Q: What is the severity of CVE-2025-47373?

CVE-2025-47373 has a CVSS score of 7.8 (HIGH). This CVE describes a memory corruption vulnerability in Qualcomm Trusted Application (TA) invocation where accessing buffers with invalid length can lead to arbitrary code execution. It affects devices with Qualcomm chipsets that use the vulnerable TA implementation. Attackers could potentially exploit this to gain elevated privileges on affected systems.

7.8 HIGH

📋 TL;DR

This CVE describes a memory corruption vulnerability in Qualcomm Trusted Application (TA) invocation where accessing buffers with invalid length can lead to arbitrary code execution. It affects devices with Qualcomm chipsets that use the vulnerable TA implementation. Attackers could potentially exploit this to gain elevated privileges on affected systems.

💻 Affected Systems

Products:

Qualcomm chipsets with Trusted Application (TA) functionality

Versions: Specific versions not detailed in reference; affected versions would be those prior to the March 2026 security bulletin patches

Operating Systems: Android and other OSes using Qualcomm chipsets with TA functionality

Default Config Vulnerable: ⚠️ Yes

Notes: Requires local access to invoke TA with malicious parameters; affects systems using Qualcomm's TrustZone implementation

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary code with kernel privileges, potentially leading to persistent backdoors, data theft, or device bricking.

🟠

Likely Case

Local privilege escalation allowing attackers to gain elevated system access from a lower-privileged context, potentially leading to data compromise or further system exploitation.

🟢

If Mitigated

Limited impact with proper access controls and isolation mechanisms in place, potentially contained within the TA execution environment.

🌐 Internet-Facing: LOW

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to invoke TA with crafted parameters; memory corruption vulnerabilities in TA environments can be challenging to exploit reliably

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches included in March 2026 Qualcomm security bulletin

Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html

Restart Required: Yes

Instructions:

1. Check device manufacturer for security updates. 2. Apply Qualcomm March 2026 security bulletin patches. 3. Update device firmware to latest version. 4. Reboot device after update.

🔧 Temporary Workarounds

Restrict TA invocation permissions

all

Limit which applications can invoke Trusted Applications to reduce attack surface

Enable SELinux/security hardening

linux

Implement strict mandatory access controls to contain potential privilege escalation

🧯 If You Can't Patch

Implement strict application sandboxing to limit TA invocation capabilities
Deploy endpoint detection and response (EDR) solutions to monitor for suspicious TA activity

🔍 How to Verify

Check if Vulnerable:

Check device security patch level - if before March 2026 Qualcomm patches, likely vulnerable. Review Qualcomm chipset version and firmware.

Check Version:

On Android: 'getprop ro.build.version.security_patch' or 'getprop ro.boot.qfuse'

Verify Fix Applied:

Verify device has March 2026 or later security patches applied. Check Qualcomm security bulletin for specific chipset fixes.

📡 Detection & Monitoring

Log Indicators:

Unusual TA invocation patterns
Failed TA authentication attempts
Memory access violations in TrustZone logs

Network Indicators:

Not applicable - local vulnerability

SIEM Query:

Search for: 'TrustZone', 'TA invocation', 'memory corruption' in system logs with abnormal patterns

📊 Metadata

CVE ID: CVE-2025-47373

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: March 2, 2026

Last Updated: March 4, 2026

🔗 References

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Ar8035 Firmware by Qualcomm

Cologne Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Fwa Gen 3 Ultra Firmware by Qualcomm

G1 Gen 1 Firmware by Qualcomm

G2 Gen 1 Firmware by Qualcomm

Iq 615 Firmware by Qualcomm

Iq 8275 Firmware by Qualcomm

Iq 8300 Firmware by Qualcomm

Iq 9075 Firmware by Qualcomm

Iq 9100 Firmware by Qualcomm

Lemans Au Lgit Firmware by Qualcomm

Lemansau Firmware by Qualcomm

Milos Firmware by Qualcomm

Monaco Iot Firmware by Qualcomm

Netrani Firmware by Qualcomm

Orne Firmware by Qualcomm

Palawan25 Firmware by Qualcomm

Pandeiro Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8620p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qamsrv1m Firmware by Qualcomm

Qca0000 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6584au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6678aq Firmware by Qualcomm

Qca6688aq Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6698au Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca8695au Firmware by Qualcomm

Qcc710 Firmware by Qualcomm

Qcm4325 Firmware by Qualcomm

Qcm4490 Firmware by Qualcomm

Qcm5430 Firmware by Qualcomm

Qcm6490 Firmware by Qualcomm

Qcn6224 Firmware by Qualcomm

Qcn6274 Firmware by Qualcomm

Qcn9011 Firmware by Qualcomm

Qcn9012 Firmware by Qualcomm

Qcs4290 Firmware by Qualcomm

Qcs4490 Firmware by Qualcomm

Qcs8550 Firmware by Qualcomm

Qdx1010 Firmware by Qualcomm

Qdx1011 Firmware by Qualcomm

Qep8111 Firmware by Qualcomm

Qfw7114 Firmware by Qualcomm

Qfw7124 Firmware by Qualcomm

Qln1083bd Firmware by Qualcomm

Qln1086bd Firmware by Qualcomm

Qmp1000 Firmware by Qualcomm

Qpa1083bd Firmware by Qualcomm

Qpa1086bd Firmware by Qualcomm

Qru1032 Firmware by Qualcomm

Qualcomm Dragonwing Qru100 Platform Firmware by Qualcomm

Qualcomm Dragonwing X100 Accelerator Card Firmware by Qualcomm

Qxm1083 Firmware by Qualcomm

Qxm1086 Firmware by Qualcomm

Qxm1093 Firmware by Qualcomm

Qxm1094 Firmware by Qualcomm

Qxm1095 Firmware by Qualcomm

Qxm1096 Firmware by Qualcomm

Sa6145p Firmware by Qualcomm