---
id: CVE-2025-21428
title: Buffer Over-read in WLAN Host
summary: >-
  Memory corruption occurs while connecting a STA to an AP and initiating an ADD
  TS request from the AP to establish a TSpec session.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-126
vendor: 'Qualcomm, Inc.'
product: Snapdragon
affected:
  - Snapdragon 9206 LTE Modem
  - Snapdragon APQ8017
  - Snapdragon AR8031
  - Snapdragon C-V2X 9150
  - Snapdragon CSRA6620
  - Snapdragon CSRA6640
  - Snapdragon FastConnect 6200
  - Snapdragon FastConnect 6900
  - Snapdragon MDM9250
  - Snapdragon MDM9628
  - Snapdragon MDM9640
  - Snapdragon MDM9650
  - Snapdragon MSM8996AU
  - Snapdragon QCA6174
  - Snapdragon QCA6174A
  - Snapdragon QCA6175A
  - Snapdragon QCA6554A
  - Snapdragon QCA6564A
  - Snapdragon QCA6564AU
  - Snapdragon QCA6574
  - Snapdragon QCA6574A
  - Snapdragon QCA6574AU
  - Snapdragon QCA6584
  - Snapdragon QCA6584AU
  - Snapdragon QCA6595
  - Snapdragon QCA6595AU
  - Snapdragon QCA6696
  - Snapdragon QCA9367
  - Snapdragon QCA9377
  - Snapdragon QCA9379
  - Snapdragon QCM2150
  - Snapdragon QEP8111
  - Snapdragon Qualcomm 205 Mobile Platform
  - Snapdragon Qualcomm 215 Mobile Platform
  - Snapdragon SA2150P
  - Snapdragon SD626
  - Snapdragon SDM429W
  - Snapdragon Smart Audio 200 Platform
  - Snapdragon Smart Audio 400 Platform
  - Snapdragon Smart Display 200 Platform (APQ5053-AA)
  - Snapdragon Snapdragon 1200 Wearable Platform
  - Snapdragon Snapdragon 210 Processor
  - Snapdragon Snapdragon 212 Mobile Platform
  - Snapdragon Snapdragon 425 Mobile Platform
  - Snapdragon Snapdragon 429 Mobile Platform
  - Snapdragon Snapdragon 439 Mobile Platform
  - Snapdragon Snapdragon 625 Mobile Platform
  - Snapdragon Snapdragon 626 Mobile Platform
  - Snapdragon Snapdragon 632 Mobile Platform
  - Snapdragon Snapdragon 820 Automotive Platform
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2025-04-08T03:56:08.408314Z'
published: '2025-04-07'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:54.676Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21428'
references:
  - url: >-
      https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
tags:
  - cve.org
epss: 0.00263
epssPercentile: 0.18241
ingestedAt: '2026-11-05T20:33:06.540Z'
---

## Overview

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

## Affected

- `Snapdragon 9206 LTE Modem`
- `Snapdragon APQ8017`
- `Snapdragon AR8031`
- `Snapdragon C-V2X 9150`
- `Snapdragon CSRA6620`
- `Snapdragon CSRA6640`
- `Snapdragon FastConnect 6200`
- `Snapdragon FastConnect 6900`
- `Snapdragon MDM9250`
- `Snapdragon MDM9628`
- `Snapdragon MDM9640`
- `Snapdragon MDM9650`
- `Snapdragon MSM8996AU`
- `Snapdragon QCA6174`
- `Snapdragon QCA6174A`
- `Snapdragon QCA6175A`
- `Snapdragon QCA6554A`
- `Snapdragon QCA6564A`
- `Snapdragon QCA6564AU`
- `Snapdragon QCA6574`
- `Snapdragon QCA6574A`
- `Snapdragon QCA6574AU`
- `Snapdragon QCA6584`
- `Snapdragon QCA6584AU`
- `Snapdragon QCA6595`
- `Snapdragon QCA6595AU`
- `Snapdragon QCA6696`
- `Snapdragon QCA9367`
- `Snapdragon QCA9377`
- `Snapdragon QCA9379`
- `Snapdragon QCM2150`
- `Snapdragon QEP8111`
- `Snapdragon Qualcomm 205 Mobile Platform`
- `Snapdragon Qualcomm 215 Mobile Platform`
- `Snapdragon SA2150P`
- `Snapdragon SD626`
- `Snapdragon SDM429W`
- `Snapdragon Smart Audio 200 Platform`
- `Snapdragon Smart Audio 400 Platform`
- `Snapdragon Smart Display 200 Platform (APQ5053-AA)`
- `Snapdragon Snapdragon 1200 Wearable Platform`
- `Snapdragon Snapdragon 210 Processor`
- `Snapdragon Snapdragon 212 Mobile Platform`
- `Snapdragon Snapdragon 425 Mobile Platform`
- `Snapdragon Snapdragon 429 Mobile Platform`
- `Snapdragon Snapdragon 439 Mobile Platform`
- `Snapdragon Snapdragon 625 Mobile Platform`
- `Snapdragon Snapdragon 626 Mobile Platform`
- `Snapdragon Snapdragon 632 Mobile Platform`
- `Snapdragon Snapdragon 820 Automotive Platform`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.