CVE-2025-47388: High Severity Vulnerability in dsp-kernel Package
Summary
CVE-2025-47388: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2026-03-05. Fixed in SoCVersion:2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dsp-kernel package, developed by Qualcomm for the Android ecosystem, is integral for digital signal processing tasks within mobile devices. It provides essential functionalities that enhance audio and video processing capabilities. However, this package has been identified as vulnerable to a high-severity issue that could potentially compromise system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-47388 originates from a flaw in the fastrpc_get_args function within the dsp-kernel package. This issue could allow an attacker to exploit the function, leading to unauthorized access or manipulation of sensitive data. The ramifications of this vulnerability are significant, as it could result in system crashes or unauthorized control over the device's processing capabilities.
How To Fix
Minimum fixed version
SoCVersion:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
In summary, CVE-2025-47388 is a significant vulnerability in the dsp-kernel package that requires immediate attention. Users are advised to update to the patched version to ensure their systems remain secure and functional.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2025-47388 is a high-severity vulnerability found in the dsp-kernel package, which could allow unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unauthorized control over device processing capabilities, system crashes, or data manipulation.
Yes, a patch is available as of March 5, 2026. It is recommended to update the dsp-kernel package to the patched version.
Vulert is a monitoring tool that uses the gradle.lockfile to alert users in real-time about open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
