First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-47377

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	AR8035; FastConnect 6200; FastConnect 6900; FastConnect 7800; Flight RB5 5G Platform; FWA Gen 3 Ultra Platform; G1 Gen 1; LeMans_AU_LGIT; LeMansAU; Milos; QAM8255P; QAM8295P; QAMSRV1H; QAMSRV1M; QCA6174A; QCA6391; QCA6574; QCA6574A; QCA6574AU; QCA6584AU

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.htmlPatch, Vendor Advisory

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-473787.1Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.CVE-2025-473797.8Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buff CVE-2025-47389.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yirmibes Software MY ERP allows SQL In CVE-2025-473807.8Memory corruption while preprocessing IOCTLs in sensors.CVE-2025-473817.8Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.CVE-2025-473827.8Memory corruption while loading an invalid firmware in boot loader.CVE-2025-473837.2Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.CVE-2025-473846.5Transient DOS when MAC configures config id greater than supported maximum value.CVE-2025-473857.8Memory Corruption when accessing trusted execution environment without proper privilege check.CVE-2025-473867.8Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.CVE-2025-473877.8Memory Corruption when processing IOCTLs for JPEG data without verification.CVE-2025-473887.8Memory corruption while passing pages to DSP with an unaligned starting address.

CVE-2025-47377: High severity, CVSS 7.8 | Vulnix