Severe flaws, including a critical secure boot vulnerability, impact Snapdragon platforms across mobile, automotive, and AR devices.
Millions of high-end smart devices may have been — and may continue to be at risk — because of severe flaws recently discovered in a commonly-used processor.
On 1 Dec 2025, Qualcomm released a critical security bulletin outlining multiple critical vulnerabilities in its chipset ecosystem.
The most severe flaw is CVE-2025-47372, rated with a CVSS score of 9.0, involving a critical buffer overflow in the secure boot process. This vulnerability enables attackers to bypass boot verification, potentially installing persistent malicious firmware or fully compromising devices before the operating system loads. It affects a broad range of Snapdragon, QAM, and QCA platforms, including recent Snapdragon SOCs and FastConnect modules.
Alongside this, five other high-priority vulnerabilities (many yet to be fully listed in the NIST) were disclosed:
- CVE-2025-47319 (CVSS score 6.7), which exposes Trusted Application communication interfaces to unauthorized system layers
- CVE-2025-47323 (CVSS score 7.8), an integer overflow causing audio packet routing memory corruption
- CVE-2025-47325 (CVSS score 6.5), a TrustZone firmware pointer dereference flaw
- CVE-2025-47350 (CVSS score 7.8), a use-after-free vulnerability in DSP services
- CVE-2025-47387 (CVSS score 7.8), a camera subsystem flaw involving untrusted pointer dereference during JPEG processing. These issues span devices including mobile, automotive, AR/VR, and compute platforms.
Moderate severity issues were also identified in the security bulletin, such as buffer overflows and use-after-free bugs in core services and open-source components managed through CodeLinaro. For example, CVE-2025-47322 (CVSS score 7.8), a use-after-free vulnerability affecting automotive Android OS, impacts numerous Snapdragon chip families across automotive, compute, mobile, and IoT markets.
Qualcomm has released patches for all high and critical vulnerabilities, and has urged OEMs to deploy these updates promptly.
Amid the manufacturer’s long history of security lags in hardware and software layers, the latest bulletin underscores the need for rapid and thorough patch application by device manufacturers and ecosystem partners.
Users should verify patch status with their device manufacturers to guard against exploitation risks posed by these chipset-level flaws.
