---
id: CVE-2025-47404
title: >-
  Memory corruption when dynamically changing the size of a previously allocated
  buffer while its contents are being modified.
summary: >-
  Memory corruption when dynamically changing the size of a previously allocated
  buffer while its contents are being modified.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-120
  - CWE-787
vendor: qualcomm
product: qca8695au_firmware
affected:
  - qca8695au_firmware
  - qca9367_firmware
  - qca9377_firmware
  - qcc710_firmware
  - qcm2290_firmware
  - qcm4325_firmware
  - qcm5430_firmware
  - qcm6125_firmware
  - qcm6490_firmware
  - qcn6224_firmware
  - qcn6274_firmware
  - qcn9011_firmware
  - qcn9012_firmware
  - qcs2290_firmware
  - qcs4290_firmware
  - qcs6690_firmware
  - qcs8550_firmware
  - qep8111_firmware
  - qfw7114_firmware
  - qfw7124_firmware
  - qrb5165m_firmware
  - qrb5165n_firmware
  - 215_mobile_firmware
  - video_collaboration_vc1_firmware
  - video_collaboration_vc3_firmware
  - video_collaboration_vc5_firmware
  - robotics_rb2_firmware
  - robotics_rb5_firmware
  - sa2150p_firmware
  - sa4150p_firmware
  - sa4155p_firmware
  - sa6145p_firmware
  - sa6150p_firmware
  - sa6155_firmware
  - sa6155p_firmware
  - sa7255p_firmware
  - sa7775p_firmware
  - sa8145p_firmware
  - sa8150p_firmware
  - sa8155_firmware
  - 5g_fixed_wireless_access_firmware
  - ar8031_firmware
  - ar8035_firmware
  - c-v2x_9150_firmware
  - csra6620_firmware
  - csra6640_firmware
  - fastconnect_6200_firmware
  - fastconnect_6700_firmware
  - fastconnect_6800_firmware
  - fastconnect_6900_firmware
  - fastconnect_7800_firmware
  - flight_rb5_5g_firmware
  - fwa_gen_3_ultra_firmware
  - g1_gen_1_firmware
  - g3x_gen_2_firmware
  - kalpeni_firmware
  - lemans_au_lgit_firmware
  - lemansau_firmware
  - mdm9250_firmware
  - mdm9628_firmware
  - milos_firmware
  - milos_iot_firmware
  - qam8255p_firmware
  - qam8295p_firmware
  - qamsrv1h_firmware
  - qamsrv1m_firmware
  - qca2066_firmware
  - qca6174a_firmware
  - qca6391_firmware
  - qca6564a_firmware
  - qca6564au_firmware
  - qca6574_firmware
  - qca6574a_firmware
  - qca6574au_firmware
  - qca6584au_firmware
  - qca6595_firmware
  - qca6595au_firmware
  - qca6678aq_firmware
  - qca6688aq_firmware
  - qca6696_firmware
  - qca6698aq_firmware
  - qca6698au_firmware
  - qca6797aq_firmware
  - qca8081_firmware
  - qca8337_firmware
  - wcd9390_firmware
  - wcd9395_firmware
  - wcn3615_firmware
  - wcn3660b_firmware
  - wcn3680b_firmware
  - wcn3910_firmware
  - wcn3950_firmware
  - wcn3980_firmware
  - wcn3988_firmware
  - wcn3990_firmware
  - wcn6450_firmware
  - wcn6650_firmware
  - wcn6755_firmware
  - wcn7861_firmware
  - wcn7881_firmware
published: '2026-05-04'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-47404'
references:
  - url: >-
      https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html
    label: product-security@qualcomm.com
tags:
  - nvd
epss: 0.00066
epssPercentile: 0.00014
ingestedAt: '2026-09-30T22:27:27.776Z'
---

## Overview

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

## Affected

- `qca8695au_firmware`
- `qca9367_firmware`
- `qca9377_firmware`
- `qcc710_firmware`
- `qcm2290_firmware`
- `qcm4325_firmware`
- `qcm5430_firmware`
- `qcm6125_firmware`
- `qcm6490_firmware`
- `qcn6224_firmware`
- `qcn6274_firmware`
- `qcn9011_firmware`
- `qcn9012_firmware`
- `qcs2290_firmware`
- `qcs4290_firmware`
- `qcs6690_firmware`
- `qcs8550_firmware`
- `qep8111_firmware`
- `qfw7114_firmware`
- `qfw7124_firmware`
- `qrb5165m_firmware`
- `qrb5165n_firmware`
- `215_mobile_firmware`
- `video_collaboration_vc1_firmware`
- `video_collaboration_vc3_firmware`
- `video_collaboration_vc5_firmware`
- `robotics_rb2_firmware`
- `robotics_rb5_firmware`
- `sa2150p_firmware`
- `sa4150p_firmware`
- `sa4155p_firmware`
- `sa6145p_firmware`
- `sa6150p_firmware`
- `sa6155_firmware`
- `sa6155p_firmware`
- `sa7255p_firmware`
- `sa7775p_firmware`
- `sa8145p_firmware`
- `sa8150p_firmware`
- `sa8155_firmware`
- `5g_fixed_wireless_access_firmware`
- `ar8031_firmware`
- `ar8035_firmware`
- `c-v2x_9150_firmware`
- `csra6620_firmware`
- `csra6640_firmware`
- `fastconnect_6200_firmware`
- `fastconnect_6700_firmware`
- `fastconnect_6800_firmware`
- `fastconnect_6900_firmware`
- `fastconnect_7800_firmware`
- `flight_rb5_5g_firmware`
- `fwa_gen_3_ultra_firmware`
- `g1_gen_1_firmware`
- `g3x_gen_2_firmware`
- `kalpeni_firmware`
- `lemans_au_lgit_firmware`
- `lemansau_firmware`
- `mdm9250_firmware`
- `mdm9628_firmware`
- `milos_firmware`
- `milos_iot_firmware`
- `qam8255p_firmware`
- `qam8295p_firmware`
- `qamsrv1h_firmware`
- `qamsrv1m_firmware`
- `qca2066_firmware`
- `qca6174a_firmware`
- `qca6391_firmware`
- `qca6564a_firmware`
- `qca6564au_firmware`
- `qca6574_firmware`
- `qca6574a_firmware`
- `qca6574au_firmware`
- `qca6584au_firmware`
- `qca6595_firmware`
- `qca6595au_firmware`
- `qca6678aq_firmware`
- `qca6688aq_firmware`
- `qca6696_firmware`
- `qca6698aq_firmware`
- `qca6698au_firmware`
- `qca6797aq_firmware`
- `qca8081_firmware`
- `qca8337_firmware`
- `wcd9390_firmware`
- `wcd9395_firmware`
- `wcn3615_firmware`
- `wcn3660b_firmware`
- `wcn3680b_firmware`
- `wcn3910_firmware`
- `wcn3950_firmware`
- `wcn3980_firmware`
- `wcn3988_firmware`
- `wcn3990_firmware`
- `wcn6450_firmware`
- `wcn6650_firmware`
- `wcn6755_firmware`
- `wcn7861_firmware`
- `wcn7881_firmware`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.