1. Home
  2. Vulnerabilities
  3. CVE-2025-21476
7.8
HIGH CVSS 3.1
CVE-2025-21476
Buffer Copy Without Checking Size of Input in Computer Vision
Description

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.

INFO

Published Date :

Sept. 24, 2025, 4:15 p.m.

Last Modified :

Sept. 25, 2025, 4:08 p.m.

Remotely Exploit :

No

Source :

[email protected]
Affected Products

The following products are affected by CVE-2025-21476 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Qualcomm qca6391_firmware
2 Qualcomm wcn6855_firmware
3 Qualcomm wcn6856_firmware
4 Qualcomm wcn7850_firmware
5 Qualcomm wcn7851_firmware
6 Qualcomm wcn6750_firmware
7 Qualcomm qca6698aq_firmware
8 Qualcomm qcm6490_firmware
9 Qualcomm qcn9011_firmware
10 Qualcomm qcn9012_firmware
11 Qualcomm qcn9274_firmware
12 Qualcomm qcs6490_firmware
13 Qualcomm wcn3910_firmware
14 Qualcomm wcn3950_firmware
15 Qualcomm qcs8550_firmware
16 Qualcomm qcm8550_firmware
17 Qualcomm sm8550p_firmware
18 Qualcomm sg8275p_firmware
19 Qualcomm qca6391
20 Qualcomm wcn3910
21 Qualcomm wcn3950
22 Qualcomm wcn6750
23 Qualcomm wcn6856
24 Qualcomm qcn9012
25 Qualcomm wcn6855
26 Qualcomm qcm5430_firmware
27 Qualcomm qcs5430_firmware
28 Qualcomm sg8275_firmware
29 Qualcomm sm8550_firmware
30 Qualcomm wcn7850
31 Qualcomm wcn7851
32 Qualcomm qcs6490
33 Qualcomm qca6698aq
34 Qualcomm qcm5430
35 Qualcomm qcm6490
36 Qualcomm qcm8550
37 Qualcomm qcn9011
38 Qualcomm qcs5430
39 Qualcomm qcs8550
40 Qualcomm sg8275p
41 Qualcomm sm8550p
42 Qualcomm qcn9274
43 Qualcomm sm8635_firmware
44 Qualcomm sm8635
45 Qualcomm sm8750_firmware
46 Qualcomm sm8750
47 Qualcomm wcn6755_firmware
48 Qualcomm wcn6755
49 Qualcomm wcn7880_firmware
50 Qualcomm wcn7880
51 Qualcomm wcn6650_firmware
52 Qualcomm wcn6650
53 Qualcomm sg8275
54 Qualcomm wcn7881_firmware
55 Qualcomm wcn7881
56 Qualcomm wcn7861_firmware
57 Qualcomm wcn7861
58 Qualcomm wcn7860_firmware
59 Qualcomm wcn7860
60 Qualcomm sm8750p_firmware
61 Qualcomm sm8750p
62 Qualcomm qcs9100_firmware
63 Qualcomm qcs9100
64 Qualcomm sm8550
65 Qualcomm sm6650_firmware
66 Qualcomm sm6650
67 Qualcomm sm7635_firmware
68 Qualcomm sm7635
69 Qualcomm sm7675_firmware
70 Qualcomm sm7675
71 Qualcomm sm7675p_firmware
72 Qualcomm sm7675p
73 Qualcomm sm8635p_firmware
74 Qualcomm sm8635p
75 Qualcomm sxr2330p_firmware
76 Qualcomm sxr2330p
77 Qualcomm qcs615_firmware
78 Qualcomm qcs615
79 Qualcomm sm8650q_firmware
80 Qualcomm sm8650q
81 Qualcomm sm8650_firmware
82 Qualcomm sm8650
83 Qualcomm sm8650p_firmware
84 Qualcomm sm8650p
: Total Affected Vendor : 1 | Products : 84
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 2cfc7d3e-20d3-47ac-8db7-1b7285aff15f
CVSS 3.1 HIGH [email protected]
Solution
Update the system to patch memory corruption vulnerabilities related to Trusted Virtual Machine handshakes.
  • Apply the latest security updates from the vendor.
  • Ensure Trusted Virtual Machine parameters are validated.
  • Review handshake protocol for security flaws.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-21476.

URL Resource
https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html Vendor Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-21476 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-21476 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-67: String Format Overflow in syslog() String Format Overflow in syslog() CAPEC-92: Forced Integer Overflow Forced Integer Overflow CAPEC-100: Overflow Buffers Overflow Buffers

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-21476 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-21476 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Sep. 25, 2025

    Action Type Old Value New Value
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcs9100_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcs9100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sg8275_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sg8275:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sg8275p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sg8275p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8550_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8550:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8650_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8650:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8650p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8650p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8750_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8750:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcn9274:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn6855:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7850:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7851:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:qualcomm:qcs615_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:qualcomm:qcs615:-:*:*:*:*:*:*:*
    Added Reference Type Qualcomm, Inc.: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html Types: Vendor Advisory
  • New CVE Received by [email protected]

    Sep. 24, 2025

    Action Type Old Value New Value
    Added Description Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-120
    Added Reference https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact