CVE-2025-21445: Qualcomm QAM8255P Buffer Overflow Vulnerability

CVE-2025-21445 Overview

CVE-2025-21445 is a memory corruption vulnerability affecting Qualcomm automotive and connectivity firmware. The flaw occurs when copying results into a transmission queue shared between a virtual machine and the host. An authenticated local attacker with low privileges can trigger the corruption to compromise confidentiality, integrity, and availability of the affected system. The issue is tracked as CWE-120 (buffer copy without checking size of input) and is documented in the Qualcomm July 2025 Security Bulletin.

Critical Impact
Successful exploitation enables local privilege escalation and cross-boundary memory corruption between guest VMs and the host, threatening isolation on affected Qualcomm automotive and connectivity platforms.

Affected Products

Qualcomm automotive SoCs and firmware: QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M
Qualcomm connectivity chipsets: QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ
Qualcomm Snapdragon Auto platforms: SA7255P, SA7775P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P, SRV1H, SRV1L, SRV1M

Discovery Timeline

2025-07-08 - CVE-2025-21445 published to the National Vulnerability Database
2025-07 - Qualcomm publishes fixes in the July 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21445

Vulnerability Analysis

The vulnerability resides in the code path that copies operation results into a transmission queue mapped between a guest virtual machine and the host. Because the shared queue crosses a trust boundary, any missing bounds check on the copy operation allows an attacker inside the VM to write past the intended buffer. The corruption occurs in memory the host processes, which is what elevates the impact beyond a guest-only crash.

The underlying weakness is a classic buffer copy without input size validation, categorized under CWE-120. On affected Qualcomm platforms, the shared transmission queue is used by virtualized services that mediate hardware and connectivity functions, making it reachable from workloads running with only low privileges inside the guest.

Root Cause

The root cause is the absence of length validation when writing operation results into the shared transmission queue. The producer code assumes the response payload fits within the queue slot without verifying the actual size against the destination buffer. An oversized or attacker-influenced result triggers a linear overflow into adjacent structures used by the host-side consumer.

Attack Vector

Exploitation requires local access with low privileges on the guest VM. No user interaction is required. An attacker triggers the vulnerable code path by issuing a request whose result, when serialized into the transmission queue, exceeds the buffer size. The overflow corrupts memory shared with the host and can be leveraged for privilege escalation or breaking VM-to-host isolation.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2025-21445 as of publication. Technical details are limited to the vendor advisory referenced above.

Detection Methods for CVE-2025-21445

Indicators of Compromise

Unexpected kernel panics, hypervisor faults, or host-side crashes originating from services that handle guest transmission queues.
Log entries showing malformed or oversized responses returned from guest workloads on affected Qualcomm platforms.
Anomalous restarts of virtualized services on SA8*, QAM8*, or QCA6* firmware after guest activity.

Detection Strategies

Verify firmware versions against the Qualcomm July 2025 Security Bulletin fixed-version matrix.
Monitor host and hypervisor logs for repeated crashes or watchdog resets tied to VM-shared memory regions.
Inspect guest workloads for unauthorized processes issuing high volumes of requests to virtualized backends.

Monitoring Recommendations

Baseline normal transmission-queue message sizes and alert on outliers that exceed expected bounds.
Track firmware inventory across automotive and IoT fleets to identify unpatched Qualcomm SoCs.
Correlate guest-side privilege escalation attempts with host-side memory faults using centralized telemetry.

How to Mitigate CVE-2025-21445

Immediate Actions Required

Apply the firmware updates listed in the Qualcomm July 2025 Security Bulletin to all affected SoCs.
Identify every device running the affected QAM8*, QCA6*, SA*, and SRV1* firmware families and prioritize patch deployment.
Restrict local access to guest VMs on affected platforms to trusted workloads only.

Patch Information

Qualcomm addressed CVE-2025-21445 in its July 2025 Security Bulletin. OEMs and Tier-1 integrators must incorporate the updated firmware into device software updates. Refer to the Qualcomm July 2025 Security Bulletin for the authoritative fixed-version list per SoC.

Workarounds

No vendor-published workaround exists; patching is the required remediation.
Limit which guest workloads can invoke virtualized services that use the shared transmission queue.
Enforce least privilege inside guest VMs to reduce the population of accounts able to reach the vulnerable code path.

bash

# Configuration example: inventory Qualcomm firmware versions on Linux-based automotive stacks
cat /sys/firmware/qcom/soc_id 2>/dev/null
dmesg | grep -iE "qcom|qca|sa8|qam8"
# Compare reported firmware against the fixed versions in the Qualcomm July 2025 bulletin