First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2025-21469

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-787

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	FastConnect 6700; FastConnect 6900; FastConnect 7800; QCM5430; QCM6490; QCS5430; QCS6490; Qualcomm Video Collaboration VC3 Platform; SC8380XP; Snapdragon 7c+ Gen 3 Compute; Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB); WCD9370; WCD9375; WCD9380; WCD9385; WSA8830; WSA8835; WSA8840; WSA8845; WSA8845H

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.htmlVendor Advisory

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-21477.5A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been CVE-2025-214707.8Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.CVE-2025-214725.5Information disclosure while capturing logs as eSE debug messages are logged.CVE-2025-214737.0Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.CVE-2025-214747.8Memory corruption while processing commands from A2dp sink command queue.CVE-2025-214757.8Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.CVE-2025-214767.8Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.CVE-2025-214777.5Transient DOS while processing CCCH data when NW sends data with invalid length.CVE-2025-214798.6Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.CVE-2025-21487.5A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops CVE-2025-214808.6Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.CVE-2025-214817.8Memory corruption while performing private key encryption in trusted application.

CVE-2025-21469: High severity, CVSS 7.8 | Vulnix