CVE-2025-21427 Buffer Over-read in Data HLOS - LNX
An attacker can disclose sensitive information via a buffer over-read when a user equipment receives a malicious RTP packet from the network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-21427?
CVE-2025-21427 is a high-severity vulnerability in Qualcomm Apq8064au Firmware, published on 8 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
Which versions are affected by CVE-2025-21427?
It affects 179 products.
Products include Qualcomm 205 Mobile Firmware, Qualcomm 215 Mobile Firmware, Qualcomm Apq8064au Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Fastconnect 6200 Firmware, Qualcomm Fastconnect 6700 Firmware and 173 more.
How do I fix CVE-2025-21427?
No fix has been published for CVE-2025-21427 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-21427 being exploited?
There is no known exploitation of CVE-2025-21427 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8064au Firmware
Sources
Also known as GHSA-3x8c-g2gj-p9rg.