الثغرات ›

CVE-2025-47389

مرتفع

CWE-120 — نوع الضعف

                    نُشر: Apr 6, 2026                      ·  آخر تحديث: Apr 13, 2026                      ·  المصدر: NVD                

CVSS v3

7.8

🔗 NVD الرسمي

📄 الوصف (الإنجليزية)

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

🤖 ملخص AI

CVE-2025-47389 is a memory corruption vulnerability caused by integer overflow in buffer copy operations during attestation report generation, affecting systems with CVSS score 7.8. This vulnerability could allow attackers to corrupt memory and potentially execute arbitrary code or cause denial of service.

📄 الوصف (العربية)

يتعلق هذا الضعف بتلف الذاكرة الناجم عن تجاوز عدد صحيح في عمليات نسخ المخزن المؤقت أثناء توليد تقارير الشهادة. قد يسمح للمهاجمين بتنفيذ كود عشوائي أو إحداث رفض الخدمة على الأنظمة المتأثرة.

🤖 ملخص تنفيذي (AI)

This vulnerability involves memory corruption from integer overflow in attestation report generation with high severity rating. Exploitation could lead to arbitrary code execution or system crashes in affected systems.

🤖 التحليل الذكي آخر تحليل: May 2, 2026 05:20

🇸🇦 التأثير على المملكة العربية السعودية

Saudi Relevance: high

🏢 القطاعات السعودية المتأثرة

banking telecom government healthcare

🎯 تقنيات MITRE ATT&CK

T1190 T1203 T1499

⚖️ درجة المخاطر السعودية (AI)

8.0

/ 10.0

🔧 Remediation Steps (English)

Apply security patches immediately from the vendor. Implement input validation and bounds checking for buffer operations. Deploy memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). Monitor systems for exploitation attempts and restrict access to attestation report generation functions.

🔧 خطوات المعالجة (العربية)

طبق التصحيحات الأمنية فوراً من المورد. نفذ التحقق من صحة المدخلات والتحقق من حدود العمليات. استخدم آليات حماية الذاكرة مثل ASLR و DEP. راقب محاولات الاستغلال وقيد الوصول لوظائف توليد التقارير.

📋 خريطة الامتثال التنظيمي

🟢 NCA ECC 2024

5.1.1 5.1.2

🔵 SAMA CSF

CC-6.1 CC-6.2

🟡 ISO 27001:2022

A.14.2.1 A.14.2.5

🔗 المراجع والمصادر 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin....

product-security@qualcomm.com

Vendor Advisory

📦 المنتجات المتأثرة 50 منتج

qualcomm:ar8035_firmware:-

qualcomm:cologne_firmware:-

qualcomm:csra6620_firmware:-

qualcomm:csra6640_firmware:-

qualcomm:fastconnect_6200_firmware:-

qualcomm:snapdragon_x35_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x72_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_x75_5g_modem-rf_system_firmware:-

qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-

qualcomm:snapdragon_xr2_5g_platform_firmware:-

qualcomm:srv1h_firmware:-

qualcomm:srv1l_firmware:-

qualcomm:srv1m_firmware:-

qualcomm:sw6100_firmware:-

qualcomm:sw6100p_firmware:-

qualcomm:sxr2330p_firmware:-

qualcomm:sxr2350p_firmware:-

qualcomm:themisto_firmware:-

qualcomm:video_collaboration_vc1_platform_firmware:-

qualcomm:video_collaboration_vc3_platform_firmware:-

qualcomm:wcd9335_firmware:-

qualcomm:wcd9340_firmware:-

qualcomm:wcd9370_firmware:-

qualcomm:wcd9375_firmware:-

qualcomm:wcd9378_firmware:-

qualcomm:wcd9378c_firmware:-

qualcomm:wcd9380_firmware:-

qualcomm:wcd9385_firmware:-

qualcomm:wcd9390_firmware:-

qualcomm:wcd9395_firmware:-

qualcomm:wcn3910_firmware:-

qualcomm:wcn3950_firmware:-

qualcomm:wcn3980_firmware:-

qualcomm:wcn3988_firmware:-

qualcomm:wcn6450_firmware:-

qualcomm:wcn6650_firmware:-

qualcomm:wcn6755_firmware:-

qualcomm:wcn7860_firmware:-

qualcomm:wcn7861_firmware:-

qualcomm:wcn7880_firmware:-

qualcomm:wcn7881_firmware:-

qualcomm:wsa8810_firmware:-

qualcomm:wsa8815_firmware:-

qualcomm:fastconnect_6700_firmware:-

qualcomm:fastconnect_6800_firmware:-

qualcomm:fastconnect_6900_firmware:-

qualcomm:fastconnect_7800_firmware:-

qualcomm:fwa_gen_3_ultra_firmware:-

📊 CVSS Score

7.8

/ 10.0 — مرتفع

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 حقائق سريعة

الخطورة مرتفع

CVSS Score7.8

CWECWE-120

EPSS0.01%

اختراق متاح لا

تصحيح متاح ✗ لا

تاريخ النشر 2026-04-06

المصدر nvd

المشاهدات 5

🇸🇦 درجة المخاطر السعودية

8.0

/ 10.0 — مخاطر السعودية

أولوية: HIGH

🏷️ الوسوم

CWE-120

🏢 توجيهات البائع

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ إجراءات

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 التعليقات

جارٍ التحميل

CVE-2025-47389

💬 التعليقات

عرّفنا بنفسك

تسجيل الدخول مطلوب