First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-47372

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120 CWE-787

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	QAM8255P; QAM8620P; QAM8650P; QAM8775P; QAMSRV1H; QAMSRV1M; QCA6595; QCA6595AU; QCA6678AQ; QCA6696; QCA6698AQ; QCA6797AQ; SA7255P; SA7775P; SA8255P; SA8620P; SA8650P; SA8770P; SA8775P; SA9000P

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.htmlVendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-473737.8Memory Corruption when accessing buffers with invalid length during TA invocation.CVE-2025-473746.5Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.CVE-2025-473757.8Memory corruption while handling different IOCTL calls from the user-space simultaneously.CVE-2025-473767.8Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.CVE-2025-473777.8Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.CVE-2025-473787.1Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.CVE-2025-473797.8Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buff CVE-2025-47389.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yirmibes Software MY ERP allows SQL In CVE-2025-473807.8Memory corruption while preprocessing IOCTLs in sensors.CVE-2025-473817.8Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.CVE-2025-473827.8Memory corruption while loading an invalid firmware in boot loader.CVE-2025-473837.2Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVE-2025-47372: High severity, CVSS 8.4 | Vulnix