Memory Corruption in ELF Parser: Oversized Size Abuse
CVE-2025-47372 Published on December 18, 2025
Buffer Copy Without Checking Size of Input in Boot
Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.
Vulnerability Analysis
CVE-2025-47372 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Classic Buffer Overflow Vulnerability?
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the program copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
CVE-2025-47372 has been classified to as a Classic Buffer Overflow vulnerability or weakness.
Products Associated with CVE-2025-47372
stack.watch emails you whenever new vulnerabilities are published in Google Android or Qualcomm Snapdragon. Just hit a watch button to start following.
Affected Versions
Qualcomm, Inc. Snapdragon:- Version QAM8255P is affected.
- Version QAM8620P is affected.
- Version QAM8650P is affected.
- Version QAM8775P is affected.
- Version QAMSRV1H is affected.
- Version QAMSRV1M is affected.
- Version QCA6595 is affected.
- Version QCA6595AU is affected.
- Version QCA6678AQ is affected.
- Version QCA6696 is affected.
- Version QCA6698AQ is affected.
- Version QCA6797AQ is affected.
- Version SA7255P is affected.
- Version SA7775P is affected.
- Version SA8255P is affected.
- Version SA8620P is affected.
- Version SA8650P is affected.
- Version SA8770P is affected.
- Version SA8775P is affected.
- Version SA9000P is affected.
- Version SRV1H is affected.
- Version SRV1L is affected.
- Version SRV1M is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.