CVE-2025-21445 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Data HLOS - QX

High 7.8 Published 8 Jul 2025 Updated 8 Jul 2025

A buffer overflow in Qualcomm Snapdragon firmware allows attackers to corrupt memory, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-21445?

CVE-2025-21445 is a high-severity memory corruption vulnerability in Qualcomm Qam8255p Firmware, published on 8 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Weakness: CWE-120

Which versions are affected by CVE-2025-21445?

It affects 27 products.

Products include Qualcomm Qam8255p Firmware, Qualcomm Qam8295p Firmware, Qualcomm Qam8620p Firmware, Qualcomm Qam8650p Firmware, Qualcomm Qam8775p Firmware, Qualcomm Qamsrv1h Firmware and 21 more.

How do I fix CVE-2025-21445?

No fix has been published for CVE-2025-21445 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-21445 being exploited?

There is no known exploitation of CVE-2025-21445 in the wild and no public exploit code.

All Qualcomm Qam8255p Firmware vulnerabilities

Sources

Also known as GHSA-4pxr-jjw5-gwm3.