CVE-2025-21476

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	QCM5430; QCM6490; QCM8550; QCS5430; QCS615; QCS6490; QCS8550; QCS9100; SG8275; SG8275P; SM6650; SM7635; SM7675; SM7675P; SM8550; SM8550P; SM8635; SM8635P; SM8650; SM8650P

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.htmlVendor Advisory

Timeline

Published: Sep 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-214777.5Transient DOS while processing CCCH data when NW sends data with invalid length.CVE-2025-214798.6Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.CVE-2025-21487.5A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops CVE-2025-214808.6Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.CVE-2025-214817.8Memory corruption while performing private key encryption in trusted application.CVE-2025-214827.1Cryptographic issue while performing RSA PKCS padding decoding.CVE-2025-214839.8Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.CVE-2025-214848.2Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.CVE-2025-214857.8Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.CVE-2025-214867.8Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.CVE-2025-214878.2Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the availabl CVE-2025-214888.2Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.