{"id":"CVE-2025-21456","title":"Use After Free in NPU","summary":"Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"Qualcomm, Inc.","product":"Snapdragon","affected":["Snapdragon AR8035","Snapdragon C-V2X 9150","Snapdragon FastConnect 6900","Snapdragon FastConnect 7800","Snapdragon QAM8255P","Snapdragon QAM8295P","Snapdragon QAM8650P","Snapdragon QAM8775P","Snapdragon QCA6174A","Snapdragon QCA6574AU","Snapdragon QCA6584AU","Snapdragon QCA6696","Snapdragon QCA6698AQ","Snapdragon QCA6797AQ","Snapdragon QCA8081","Snapdragon QCA8337","Snapdragon QCC710","Snapdragon QCN6224","Snapdragon QCN6274","Snapdragon QCS410","Snapdragon QCS610","Snapdragon QFW7114","Snapdragon QFW7124","Snapdragon Qualcomm Video Collaboration VC1 Platform","Snapdragon Qualcomm Video Collaboration VC3 Platform","Snapdragon SA6145P","Snapdragon SA6150P","Snapdragon SA6155P","Snapdragon SA7255P","Snapdragon SA7775P","Snapdragon SA8145P","Snapdragon SA8150P","Snapdragon SA8155P","Snapdragon SA8195P","Snapdragon SA8255P","Snapdragon SA8295P","Snapdragon SA8530P","Snapdragon SA8540P","Snapdragon SA8620P","Snapdragon SA8650P","Snapdragon SA8775P","Snapdragon SA9000P","Snapdragon Snapdragon 888 5G Mobile Platform","Snapdragon Snapdragon 888+ 5G Mobile Platform (SM8350-AC)","Snapdragon Snapdragon Auto 5G Modem-RF Gen 2","Snapdragon Snapdragon W5+ Gen 1 Wearable Platform","Snapdragon Snapdragon X72 5G Modem-RF System","Snapdragon Snapdragon X75 5G Modem-RF System","Snapdragon SW5100","Snapdragon SW5100P"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-08-07T03:55:14.073610Z"},"published":"2025-08-06","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:02:54.816Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21456","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html"}],"tags":["cve.org"],"epss":0.00093,"epssPercentile":0.00562,"ingestedAt":"2026-11-05T20:33:06.539Z","slug":"CVE-2025-21456","body":"## Overview\n\nMemory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.\n\n## Affected\n\n- `Snapdragon AR8035`\n- `Snapdragon C-V2X 9150`\n- `Snapdragon FastConnect 6900`\n- `Snapdragon FastConnect 7800`\n- `Snapdragon QAM8255P`\n- `Snapdragon QAM8295P`\n- `Snapdragon QAM8650P`\n- `Snapdragon QAM8775P`\n- `Snapdragon QCA6174A`\n- `Snapdragon QCA6574AU`\n- `Snapdragon QCA6584AU`\n- `Snapdragon QCA6696`\n- `Snapdragon QCA6698AQ`\n- `Snapdragon QCA6797AQ`\n- `Snapdragon QCA8081`\n- `Snapdragon QCA8337`\n- `Snapdragon QCC710`\n- `Snapdragon QCN6224`\n- `Snapdragon QCN6274`\n- `Snapdragon QCS410`\n- `Snapdragon QCS610`\n- `Snapdragon QFW7114`\n- `Snapdragon QFW7124`\n- `Snapdragon Qualcomm Video Collaboration VC1 Platform`\n- `Snapdragon Qualcomm Video Collaboration VC3 Platform`\n- `Snapdragon SA6145P`\n- `Snapdragon SA6150P`\n- `Snapdragon SA6155P`\n- `Snapdragon SA7255P`\n- `Snapdragon SA7775P`\n- `Snapdragon SA8145P`\n- `Snapdragon SA8150P`\n- `Snapdragon SA8155P`\n- `Snapdragon SA8195P`\n- `Snapdragon SA8255P`\n- `Snapdragon SA8295P`\n- `Snapdragon SA8530P`\n- `Snapdragon SA8540P`\n- `Snapdragon SA8620P`\n- `Snapdragon SA8650P`\n- `Snapdragon SA8775P`\n- `Snapdragon SA9000P`\n- `Snapdragon Snapdragon 888 5G Mobile Platform`\n- `Snapdragon Snapdragon 888+ 5G Mobile Platform (SM8350-AC)`\n- `Snapdragon Snapdragon Auto 5G Modem-RF Gen 2`\n- `Snapdragon Snapdragon W5+ Gen 1 Wearable Platform`\n- `Snapdragon Snapdragon X72 5G Modem-RF System`\n- `Snapdragon Snapdragon X75 5G Modem-RF System`\n- `Snapdragon SW5100`\n- `Snapdragon SW5100P`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}