CVE-2025-21431 Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

What is CVE-2025-21431?

CVE-2025-21431 is a medium-severity vulnerability in Qualcomm Qam8255p Firmware, published on 7 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Information disclosure may be there when a guest VM is connected.

Weakness: CWE-367

Which versions are affected by CVE-2025-21431?

It affects 36 products.

Products include Qualcomm Qam8255p Firmware, Qualcomm Qam8295p Firmware, Qualcomm Qam8620p Firmware, Qualcomm Qam8650p Firmware, Qualcomm Qam8775p Firmware, Qualcomm Qamsrv1h Firmware and 30 more.

How do I fix CVE-2025-21431?

No fix has been published for CVE-2025-21431 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-21431 being exploited?

There is no known exploitation of CVE-2025-21431 in the wild and no public exploit code.

Other vulnerabilities in Qualcomm Qam8255p Firmware

• CVE-2025-47372 Buffer Copy Without Checking Size of Input in Boot Critical 9.0
• CVE-2023-43517 Improper Access Control in Automotive Multimedia High 8.4
• CVE-2023-33108 Use After Free in Graphics High 8.4
• CVE-2023-33074 Use After Free in Audio High 8.4
• CVE-2025-47357 Missing Authentication for Critical Function in SMSS High 8.0

All Qualcomm Qam8255p Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p9f7-mwqh-hwrj.