CVE-2025-21449: Qualcomm Sm8635p Firmware DOS Vulnerability

CVE-2025-21449 Overview

CVE-2025-21449 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the wireless LAN stack's handling of Service Set Identifier (SSID) Information Elements (IEs). When the firmware processes a malformed length field within an SSID IE, an out-of-bounds memory access occurs, leading to a transient denial-of-service condition. The vulnerability is tracked under [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read). Qualcomm addressed the issue in its July 2025 Security Bulletin.

Critical Impact
A remote attacker within wireless range can transmit crafted 802.11 management frames containing malformed SSID IEs to trigger a denial-of-service condition on affected Snapdragon-powered mobile, automotive, IoT, and compute devices.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 4/6/7/8 Gen series, 460–888+ families)
Qualcomm FastConnect Wi-Fi subsystems (6200, 6700, 6800, 6900, 7800)
Qualcomm automotive, XR, compute, IoT, and modem-RF platforms (SA8155P, SA8295P, Snapdragon Auto 5G, Snapdragon X75, and others)

Discovery Timeline

2025-07-08 - CVE-2025-21449 published to NVD
2025-07 - Qualcomm releases security patch via July 2025 Security Bulletin
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-21449

Vulnerability Analysis

The vulnerability resides in the Wi-Fi subsystem firmware shipped across Qualcomm Snapdragon platforms. SSID Information Elements are variable-length fields in 802.11 management frames such as Beacon, Probe Request, and Probe Response frames. The IE structure encodes an element identifier, a length byte, and a variable-length payload.

When the firmware parses an SSID IE that contains a malformed length field, the parsing routine performs reads beyond the bounds of the allocated buffer. The out-of-bounds read corrupts internal state or triggers a fault that crashes the wireless subsystem. The result is a transient DoS that disrupts wireless connectivity until the affected component recovers or the device is restarted.

Root Cause

The defect stems from missing or insufficient validation of the length field embedded in SSID IEs before the firmware copies or reads payload bytes. The parsing logic trusts the attacker-supplied length value, allowing a crafted frame to drive the parser past valid buffer boundaries. This is consistent with [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read).

Attack Vector

The attack vector is network-adjacent over Wi-Fi. No authentication or user interaction is required. An attacker within radio range can broadcast 802.11 management frames containing a malformed SSID IE, and any nearby Snapdragon device that processes the frame may enter a transient DoS state. The impact is limited to availability; confidentiality and integrity are not affected.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose because no sanitized exploit code has been released. Refer to the Qualcomm Security Bulletin July 2025 for vendor-supplied technical context.

Detection Methods for CVE-2025-21449

Indicators of Compromise

Unexpected Wi-Fi subsystem crashes, driver resets, or kernel logs referencing the WLAN host driver on Qualcomm-powered devices
Repeated disconnection or association failures in proximity to unknown access points or stations broadcasting unusual beacon frames
802.11 management frames captured over the air containing SSID IEs with length fields inconsistent with the actual payload size

Detection Strategies

Deploy wireless intrusion detection (WIDS) sensors that inspect management frame IE structures and flag malformed length fields
Correlate device-side WLAN firmware crash telemetry with proximate RF events to identify deliberate frame injection
Monitor mobile device management (MDM) logs for repeated radio resets or connectivity failures across multiple devices in the same physical area

Monitoring Recommendations

Centralize endpoint and mobile telemetry, including WLAN driver crash reports, into a security data lake for correlation and trend analysis
Track Qualcomm firmware patch levels across mobile, automotive, and IoT fleets to identify unpatched devices exposed to this class of frame-injection DoS
Alert on anomalous 802.11 beacon or probe response volumes in sensitive physical environments such as data centers, vehicle fleets, and operational technology sites

How to Mitigate CVE-2025-21449

Immediate Actions Required

Inventory all Qualcomm Snapdragon, FastConnect, and modem-RF devices listed in the July 2025 Qualcomm Security Bulletin and prioritize firmware updates
Apply the OEM firmware update incorporating Qualcomm's July 2025 patch as soon as the device vendor publishes a corresponding release
Restrict the use of high-value devices to trusted wireless networks until patched firmware is deployed

Patch Information

Qualcomm has released a fix as part of its July 2025 Security Bulletin. Device OEMs must integrate the updated firmware into their respective Android, automotive, IoT, or compute platform builds and ship updates to end users. Refer to the Qualcomm Security Bulletin July 2025 for the complete list of affected components and patch identifiers.

Workarounds

Disable Wi-Fi on affected devices when patched firmware is unavailable and connectivity is not required
Limit device exposure to untrusted wireless environments such as public hotspots and uncontrolled venues
Deploy enterprise-grade wireless infrastructure with WIDS capabilities to detect and contain rogue transmitters

bash

# Verify Android device patch level against the July 2025 Qualcomm bulletin
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-07-05 or later for devices receiving the Qualcomm July 2025 fix