CVE-2025-21429: Qualcomm SA9000P Use-After-Free Flaw

CVE-2025-21429 Overview

CVE-2025-21429 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw occurs when a Wi-Fi station (STA) connects to an access point (AP) and initiates an ADD Traffic Stream (ADD TS) request. The vulnerability is classified under CWE-126: Buffer Over-read and impacts the wireless connection management code paths in affected firmware. The issue affects hundreds of Qualcomm products including Snapdragon mobile platforms, FastConnect Wi-Fi subsystems, automotive platforms, modems, and IoT chipsets.

Critical Impact
A network-adjacent attacker can trigger memory corruption during Wi-Fi association, leading to a denial-of-service condition that disrupts device availability without requiring authentication or user interaction.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 8 Gen 3, Snapdragon 8+ Gen 1, 865, 855, 695 5G, and many others)
Qualcomm FastConnect Wi-Fi subsystems (FastConnect 6200, 6700, 6800, 6900, 7800) and QCA Wi-Fi/Bluetooth chipsets
Qualcomm automotive, modem, wearable, and IoT platforms (SA8155P, SA8540P, SDX55, Snapdragon W5+ Gen 1, QCS6490, and others)

Discovery Timeline

2025-04-07 - CVE CVE-2025-21429 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-21429

Vulnerability Analysis

The vulnerability resides in the Wi-Fi connection handling code within Qualcomm firmware. During the association process between a station (STA) and an access point (AP), the device may initiate an ADD Traffic Stream (ADD TS) request. ADD TS is a Wi-Fi Multimedia (WMM) action frame used to negotiate Quality-of-Service parameters for traffic streams. Improper bounds checking during the construction or parsing of this request leads to memory corruption in firmware memory.

The weakness is mapped to CWE-126 (Buffer Over-read), indicating that the firmware reads memory beyond an intended buffer boundary. An attacker positioned within wireless range of the target or operating a rogue AP can manipulate the association exchange to trigger the condition. Successful triggering of the flaw corrupts firmware state and renders the wireless subsystem or device unavailable.

Root Cause

The root cause is improper validation of buffer boundaries during the ADD TS request flow in the Wi-Fi firmware. When the STA constructs or processes the QoS traffic specification (TSPEC) elements involved in the ADD TS exchange, length and offset values are not adequately validated against the underlying buffer size. This permits an out-of-bounds memory access that corrupts adjacent firmware data structures.

Attack Vector

Exploitation requires the target device to attempt a Wi-Fi association with an attacker-controlled or attacker-influenced access point. The attacker does not need credentials to the target device and no user interaction is needed beyond the normal Wi-Fi connection process. The impact is limited to availability — successful exploitation produces a denial of service against the Wi-Fi subsystem or the device itself. Confidentiality and integrity are not directly affected per the CVSS vector.

No public proof-of-concept exploit has been published for CVE-2025-21429 at the time of writing. Refer to the Qualcomm April 2025 Security Bulletin for the vendor-supplied technical context.

Detection Methods for CVE-2025-21429

Indicators of Compromise

Unexpected Wi-Fi subsystem crashes, kernel panics, or modem restarts coinciding with association attempts to unknown SSIDs
Repeated WLAN firmware reload events or wlan driver error messages in device logs after connecting to a new AP
Anomalous ADD TS (WMM action) frames observed in wireless packet captures with malformed TSPEC information elements

Detection Strategies

Monitor mobile device management (MDM) telemetry for elevated rates of Wi-Fi driver crashes across managed fleets running affected Qualcomm chipsets
Inspect 802.11 wireless captures for malformed WMM ADD TS request/response frames originating from untrusted access points
Correlate device firmware version inventory against the affected products list in the Qualcomm April 2025 Security Bulletin

Monitoring Recommendations

Track Qualcomm chipset firmware patch levels through endpoint management consoles and flag devices not running the April 2025 patch baseline or later
Deploy wireless intrusion detection (WIDS) sensors in sensitive environments to alert on rogue APs and unusual QoS action frame activity
Aggregate kernel and WLAN driver logs from mobile and IoT devices into a centralized logging platform to identify repeated subsystem failures tied to wireless association

How to Mitigate CVE-2025-21429

Immediate Actions Required

Apply vendor firmware updates from device OEMs that incorporate the Qualcomm April 2025 security patches as soon as they are made available
Inventory all devices using affected Qualcomm chipsets (Snapdragon, FastConnect, QCA, QCM, QCS, SDX, SA series) and prioritize patching of internet-facing or high-value assets
Restrict managed mobile and IoT devices from auto-connecting to unknown or untrusted Wi-Fi networks

Patch Information

Qualcomm addressed CVE-2025-21429 in its April 2025 security bulletin. Patches are distributed to OEMs and downstream device manufacturers, who incorporate the fixes into their firmware and software updates. Refer to the Qualcomm April 2025 Security Bulletin for the complete list of fixed components and remediation guidance.

Workarounds

Disable Wi-Fi on affected devices in environments where untrusted access points may be present until firmware updates are deployed
Configure managed devices to connect only to enterprise-controlled SSIDs through MDM Wi-Fi configuration profiles
Disable Wi-Fi Multimedia (WMM) / QoS features where supported by the device or AP configuration to reduce the likelihood of ADD TS exchanges with untrusted networks

bash

# Configuration example - restrict Wi-Fi to approved SSIDs via MDM policy (conceptual)
# Android Enterprise / iOS MDM Wi-Fi configuration profile
wifi_policy:
  allowed_ssids:
    - corp-secure-wifi
  auto_join_unknown_networks: false
  require_802_1x: true
  disable_wmm_on_untrusted: true