{"id":"CVE-2025-21428","title":"Buffer Over-read in WLAN Host","summary":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-126"],"vendor":"Qualcomm, Inc.","product":"Snapdragon","affected":["Snapdragon 9206 LTE Modem","Snapdragon APQ8017","Snapdragon AR8031","Snapdragon C-V2X 9150","Snapdragon CSRA6620","Snapdragon CSRA6640","Snapdragon FastConnect 6200","Snapdragon FastConnect 6900","Snapdragon MDM9250","Snapdragon MDM9628","Snapdragon MDM9640","Snapdragon MDM9650","Snapdragon MSM8996AU","Snapdragon QCA6174","Snapdragon QCA6174A","Snapdragon QCA6175A","Snapdragon QCA6554A","Snapdragon QCA6564A","Snapdragon QCA6564AU","Snapdragon QCA6574","Snapdragon QCA6574A","Snapdragon QCA6574AU","Snapdragon QCA6584","Snapdragon QCA6584AU","Snapdragon QCA6595","Snapdragon QCA6595AU","Snapdragon QCA6696","Snapdragon QCA9367","Snapdragon QCA9377","Snapdragon QCA9379","Snapdragon QCM2150","Snapdragon QEP8111","Snapdragon Qualcomm 205 Mobile Platform","Snapdragon Qualcomm 215 Mobile Platform","Snapdragon SA2150P","Snapdragon SD626","Snapdragon SDM429W","Snapdragon Smart Audio 200 Platform","Snapdragon Smart Audio 400 Platform","Snapdragon Smart Display 200 Platform (APQ5053-AA)","Snapdragon Snapdragon 1200 Wearable Platform","Snapdragon Snapdragon 210 Processor","Snapdragon Snapdragon 212 Mobile Platform","Snapdragon Snapdragon 425 Mobile Platform","Snapdragon Snapdragon 429 Mobile Platform","Snapdragon Snapdragon 439 Mobile Platform","Snapdragon Snapdragon 625 Mobile Platform","Snapdragon Snapdragon 626 Mobile Platform","Snapdragon Snapdragon 632 Mobile Platform","Snapdragon Snapdragon 820 Automotive Platform"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2025-04-08T03:56:08.408314Z"},"published":"2025-04-07","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:02:54.676Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21428","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"}],"tags":["cve.org"],"epss":0.00263,"epssPercentile":0.18241,"ingestedAt":"2026-11-05T20:33:06.540Z","slug":"CVE-2025-21428","body":"## Overview\n\nMemory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.\n\n## Affected\n\n- `Snapdragon 9206 LTE Modem`\n- `Snapdragon APQ8017`\n- `Snapdragon AR8031`\n- `Snapdragon C-V2X 9150`\n- `Snapdragon CSRA6620`\n- `Snapdragon CSRA6640`\n- `Snapdragon FastConnect 6200`\n- `Snapdragon FastConnect 6900`\n- `Snapdragon MDM9250`\n- `Snapdragon MDM9628`\n- `Snapdragon MDM9640`\n- `Snapdragon MDM9650`\n- `Snapdragon MSM8996AU`\n- `Snapdragon QCA6174`\n- `Snapdragon QCA6174A`\n- `Snapdragon QCA6175A`\n- `Snapdragon QCA6554A`\n- `Snapdragon QCA6564A`\n- `Snapdragon QCA6564AU`\n- `Snapdragon QCA6574`\n- `Snapdragon QCA6574A`\n- `Snapdragon QCA6574AU`\n- `Snapdragon QCA6584`\n- `Snapdragon QCA6584AU`\n- `Snapdragon QCA6595`\n- `Snapdragon QCA6595AU`\n- `Snapdragon QCA6696`\n- `Snapdragon QCA9367`\n- `Snapdragon QCA9377`\n- `Snapdragon QCA9379`\n- `Snapdragon QCM2150`\n- `Snapdragon QEP8111`\n- `Snapdragon Qualcomm 205 Mobile Platform`\n- `Snapdragon Qualcomm 215 Mobile Platform`\n- `Snapdragon SA2150P`\n- `Snapdragon SD626`\n- `Snapdragon SDM429W`\n- `Snapdragon Smart Audio 200 Platform`\n- `Snapdragon Smart Audio 400 Platform`\n- `Snapdragon Smart Display 200 Platform (APQ5053-AA)`\n- `Snapdragon Snapdragon 1200 Wearable Platform`\n- `Snapdragon Snapdragon 210 Processor`\n- `Snapdragon Snapdragon 212 Mobile Platform`\n- `Snapdragon Snapdragon 425 Mobile Platform`\n- `Snapdragon Snapdragon 429 Mobile Platform`\n- `Snapdragon Snapdragon 439 Mobile Platform`\n- `Snapdragon Snapdragon 625 Mobile Platform`\n- `Snapdragon Snapdragon 626 Mobile Platform`\n- `Snapdragon Snapdragon 632 Mobile Platform`\n- `Snapdragon Snapdragon 820 Automotive Platform`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}