Vulnerabilities ›

CVE-2025-47366

High

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

CWE-749 — Weakness Type

                    Published: Feb 2, 2026                      ·  Modified: Feb 28, 2026                      ·  Source: NVD                

CVSS v3

7.1

🔗 NVD Official

📄 Description (English)

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

🤖 AI Executive Summary

CVE-2025-47366 is a cryptographic vulnerability in Trusted Zone implementations that occurs when outdated code is triggered by incorrect High-Level Operating System (HLOS) input. This flaw could allow attackers to bypass cryptographic protections and compromise system security.

📄 Description (Arabic)

يتعلق هذا الثغرة بمشكلة تشفيرية في بيئة منطقة موثوقة (TEE) حيث يمكن تشغيل كود قديم أو غير محدث عند توفير إدخال غير صحيح من نظام التشغيل عالي المستوى. قد يؤدي هذا إلى تجاوز آليات الحماية التشفيرية وتعريض البيانات الحساسة للخطر.

🤖 ملخص تنفيذي (AI)

هذا الثغرة تتعلق بمشكلة تشفيرية في منطقة موثوقة عندما يتم تشغيل كود قديم من خلال إدخال غير صحيح من نظام التشغيل عالي المستوى. قد يسمح هذا الخلل للمهاجمين بتجاوز الحماية التشفيرية والتأثير على أمان النظام.

🤖 AI Intelligence Analysis Analyzed: May 10, 2026 02:16

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking telecom government healthcare

🎯 MITRE ATT&CK Techniques

T1190 T1499 T1565

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Update Trusted Zone firmware and code to the latest version immediately. Implement input validation mechanisms in HLOS to prevent malformed data from reaching Trusted Zone. Apply vendor security patches and conduct cryptographic implementation audits. Monitor system logs for suspicious Trusted Zone invocations.

🔧 خطوات المعالجة (العربية)

قم بتحديث برنامج منطقة موثوقة والكود إلى أحدث إصدار فوراً. طبق آليات التحقق من صحة الإدخال في نظام التشغيل عالي المستوى لمنع البيانات المشوهة من الوصول إلى منطقة موثوقة. طبق تصحيحات الأمان من المورد وأجرِ تدقيقات تنفيذ التشفير. راقب سجلات النظام للكشف عن استدعاءات مريبة لمنطقة موثوقة.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1 5.2 6.1

🔵 SAMA CSF

CC6.1 CC6.2 CC7.2

🟡 ISO 27001:2022

A.10.1.1 A.10.2.1 A.13.1.1

🔗 References & Sources 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2026-bullet...

product-security@qualcomm.com

Vendor Advisory

📦 Affected Products / CPE 50 entries

qualcomm:ar8035_firmware:-

qualcomm:fastconnect_6200_firmware:-

qualcomm:fastconnect_6700_firmware:-

qualcomm:fastconnect_6900_firmware:-

qualcomm:fastconnect_7800_firmware:-

qualcomm:qdx1011_firmware:-

qualcomm:qep8111_firmware:-

qualcomm:qfw7114_firmware:-

qualcomm:qfw7124_firmware:-

qualcomm:qmp1000_firmware:-

qualcomm:qrb5165m_firmware:-

qualcomm:qrb5165n_firmware:-

qualcomm:qru1032_firmware:-

qualcomm:qru1052_firmware:-

qualcomm:qru1062_firmware:-

qualcomm:video_collaboration_vc3_firmware:-

qualcomm:video_collaboration_vc5_firmware:-

qualcomm:robotics_rb5_firmware:-

qualcomm:sa4150p_firmware:-

qualcomm:sa4155p_firmware:-

qualcomm:sa6145p_firmware:-

qualcomm:sa6150p_firmware:-

qualcomm:sa6155p_firmware:-

qualcomm:sa7255p_firmware:-

qualcomm:sa7775p_firmware:-

qualcomm:sa8145p_firmware:-

qualcomm:sa8150p_firmware:-

qualcomm:sa8155p_firmware:-

qualcomm:sa8195p_firmware:-

qualcomm:sa8255p_firmware:-

qualcomm:sa8295p_firmware:-

qualcomm:sa8540p_firmware:-

qualcomm:sa8620p_firmware:-

qualcomm:sa8650p_firmware:-

qualcomm:sa8770p_firmware:-

qualcomm:sa8775p_firmware:-

qualcomm:sa9000p_firmware:-

qualcomm:sc8380xp_firmware:-

qualcomm:sd_8_gen1_5g_firmware:-

qualcomm:sg4150p_firmware:-

qualcomm:sm4635_firmware:-

qualcomm:sm6225p_firmware:-

qualcomm:sm6475_firmware:-

qualcomm:sm6650_firmware:-

qualcomm:sm6650p_firmware:-

qualcomm:flight_rb5_5g_firmware:-

qualcomm:qam8255p_firmware:-

qualcomm:qam8295p_firmware:-

qualcomm:qam8620p_firmware:-

qualcomm:qam8650p_firmware:-

📊 CVSS Score

7.1

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.1

CWECWE-749

EPSS0.01%

Exploit No

Patch ✓ Yes

Published 2026-02-02

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-749

🏢 Vendor Advisories

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2025-47366

💬 Comments

Introduce Yourself

Sign In Required