CVE-2025-21486

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-822

Affected software

VendorProductVersions
Qualcomm, Inc.SnapdragonFastConnect 6900; FastConnect 7800; QMP1000; SM8735; SM8750; SM8750P; Snapdragon W5+ Gen 1 Wearable Platform; SW5100; SW5100P; SXR2230P; SXR2250P; SXR2330P; WCD9378; WCD9380; WCD9385; WCD9395; WCN3660B; WCN3680B; WCN3980; WCN3988

References

Timeline

Published
Jun 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-214878.2Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the availablCVE-2025-214888.2Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.CVE-2025-214896.1Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions CVE-2025-21492.5A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of thCVE-2025-214904.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8CVE-2025-214914.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8CVE-2025-214924.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 aCVE-2025-214934.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aCVE-2025-214944.1Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aCVE-2025-214954.4Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.CVE-2025-214975.5Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8CVE-2025-214985.3Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 1
CVE-2025-21486: High severity, CVSS 7.8 | Vulnix