Buffer over-read in Qualcomm products - CVE-2025-21488

Vulnerability identifier: #VU114640

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-21488

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Data Network Stack & Connectivity. A remote attacker can read and manipulate data.

Snapdragon XR2 5G Platform
WCD9380
WCD9378
WCD9375
WCD9370
WCD9341
WCD9340
WCD9335
WCD9326
TalynPlus
SXR1120
SW5100P
SW5100
Snapdragon XR2+ Gen 1 Platform
WCD9385
Snapdragon XR1 Platform
Snapdragon W5+ Gen 1 Wearable Platform
Snapdragon 845 Mobile Platform
Snapdragon 820 Automotive Platform
Snapdragon 8+ Gen 2 Mobile Platform
Snapdragon 8+ Gen 1 Mobile Platform
Snapdragon 8 Gen 3 Mobile Platform
Snapdragon 8 Gen 2 Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 710 Mobile Platform
Snapdragon 695 5G Mobile Platform
Snapdragon 685 4G Mobile Platform (SM6225-AD)
WCN6755
WSA8845H
WSA8845
WSA8840
WSA8835
WSA8830
WSA8815
WSA8810
WCN7881
WCN7880
WCN7861
WCN7860
WCN7750
Snapdragon 680 4G Mobile Platform
WCN6740
WCN6650
WCN6450
WCN3990
WCN3988
WCN3980
WCN3950
WCN3910
WCN3660B
WCN3620
WCD9395
WCD9390
QCM4490
SD660
SD 8 Gen1 5G
SA8155P
SA8155
SA6155
SA6145P
Qualcomm Video Collaboration VC3 Platform
Qualcomm Video Collaboration VC1 Platform
QMP1000
QCS610
QCS4490
QCS410
QCA6696
QCA6595AU
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6564
FastConnect 7800
FastConnect 6900
FastConnect 6700
SM8635P
Snapdragon 670 Mobile Platform
Snapdragon 662 Mobile Platform
Snapdragon 660 Mobile Platform
Snapdragon 480+ 5G Mobile Platform (SM4350-AC)
Snapdragon 480 5G Mobile Platform
Snapdragon 460 Mobile Platform
Snapdragon 429 Mobile Platform
Snapdragon 4 Gen 2 Mobile Platform
Snapdragon 4 Gen 1 Mobile Platform
SM8750P
SM8750
SM8735
SM8650Q
FastConnect 6200
SM8635
SM8550P
SM7675P
SM7675
SM7635
SM6650
SM6370
SM4635
SM4125
SG4150P
SD865 5G
WSA8832
SA6155P
SD670
QCA6574AU
MSM8996AU
SDM429W
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 13 2025-09-05, 14 2025-09-05, 15 2025-09-05, 16 2025-09-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets (September 2025)
• Multiple vulnerabilities in Google Android