Buffer over-read in Qualcomm products - CVE-2025-47328

Vulnerability identifier: #VU114650

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47328

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN HAL. A remote attacker can perform a denial of service (DoS) attack.

QCN9160
SM8750P
SM8750
SM8735
QXM8083
QMP1000
QFW7124
QFW7114
QCN9274
Snapdragon X72 5G Modem-RF System
QCN9074
QCN9024
QCN9012
QCN9000
QCN6432
QCN6422
QCN6412
WCN7861
WSA8845H
WSA8845
WSA8840
WSA8835
WSA8830
WCN7881
WCN7880
QCN6402
WCN7860
WCN7750
WCD9395
WCD9378
WCD9340
SW-only
Snapdragon X75 5G Modem-RF System
IPQ9008
QCA8081
QCA8080
QCA8075
QCA0000
IPQ9574
IPQ9570
IPQ9554
IPQ9048
QCA8082
IPQ5424
IPQ5332
IPQ5312
IPQ5302
IPQ5300
Immersive Home 326 Platform
Immersive Home 3210 Platform
QCA8385
QCN6274
QCN6224
QCN5224
QCN5124
QCF8001
QCF8000
QCC710
QCA8386
FastConnect 7800
QCA8384
QCA8112
QCA8111
QCA8102
QCA8101
QCA8085
QCA8084
Samsung Mobile Firmware
WSA8832
Google Android

Install security update from vendor's website.

Samsung Mobile Firmware - update to SMR-SEP-2025
Google Android - addressed in versions 13 2025-09-05, 14 2025-09-05, 15 2025-09-05, 16 2025-09-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets (September 2025)
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Samsung Mobile Firmware (September 2025)