CVE-2025-47406Medium· 6.1▾ SunlitInformation Disclosure while processing IOCTL handler callbacks without verifying buffer size.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.07%
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
x2000086_firmwarex2000090_firmwarex2000092_firmwarex2000094_firmwarexg101002_firmwarexg101032_firmwarexg101039_firmwarex2000077_firmwarewsa8845h_firmwarewsa8845_firmwarewsa8840_firmwarewsa8835_firmwarewsa8830_firmwarewcd9385_firmwarewcd9380_firmwarewcd9378c_firmwarewcd9375_firmwarewcd9370_firmwaresnapdragon_8cx_gen_3_compute_firmwaresnapdragon_7c+_gen_3_compute_firmwaresc8380xp_firmwarevideo_collaboration_vc3_platform_firmwareqcm6490_firmwareqcm5430_firmwareqca0000_firmwareiqx7181_firmwareiqx5121_firmwarefastconnect_7800_firmwarefastconnect_6900_firmwarefastconnect_6700_firmwarecologne_firmwareRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-47403Medium· 6.5Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
CVE-2025-47401Medium· 6.5Transient DOS when processing target power rate tables during channel configuration.
CVE-2025-47408High· 7.8Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
CVE-2025-47407High· 7.8Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
CVE-2025-47405High· 7.8Memory corruption when processing camera sensor input/output control codes with invalid output buffers.
CVE-2025-47404Medium· 6.5Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.