CVE-2025-21460: Qualcomm QAM8255P Buffer Overflow Vulnerability

CVE-2025-21460 Overview

CVE-2025-21460 is a memory corruption vulnerability affecting a broad set of Qualcomm automotive, connectivity, and server firmware platforms. The flaw occurs while processing a message whose buffer is controlled by a Guest Virtual Machine (VM). Because the Guest VM can continuously modify the buffer contents after validation, the host component operates on unstable, attacker-controlled data. This double-fetch style condition maps to [CWE-20] (Improper Input Validation) and [CWE-787] (Out-of-Bounds Write). Successful exploitation impacts confidentiality, integrity, and availability of the affected firmware component. Qualcomm addressed the issue in the Qualcomm May 2025 Security Bulletin.

Critical Impact
A local attacker inside a Guest VM can trigger memory corruption in the host firmware, potentially leading to arbitrary code execution and full compromise of the affected Qualcomm platform.

Affected Products

Qualcomm automotive platforms: QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, SA8155P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P
Qualcomm connectivity chipsets: QCA6574A, QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ
Qualcomm server and infotainment platforms: QAMSRV1H, QAMSRV1M, SRV1H, SRV1L, SRV1M, SA6145P, SA6150P, SA6155, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155, SA8195P

Discovery Timeline

2025-05-06 - CVE-2025-21460 published to the National Vulnerability Database (NVD)
2025-05 - Qualcomm publishes fix in the May 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21460

Vulnerability Analysis

The vulnerability resides in a Qualcomm firmware component that processes messages sourced from a Guest VM. The host reads a message buffer from shared memory that the Guest VM continues to own and modify. Because the buffer is not copied to a trusted memory region before validation and use, its contents can change between the check and the use. The result is a classic time-of-check-to-time-of-use (TOCTOU) style memory safety error that culminates in an out-of-bounds write. Exploitation requires local access and low privileges, and it does not require user interaction. Because the vulnerable code executes in the trusted host firmware context, corruption there has an outsized impact on the platform's security boundary.

Root Cause

The root cause is improper input validation combined with unsafe access to shared, guest-controlled memory. The host firmware trusts a message buffer that remains writable by the Guest VM throughout processing. Length fields, offsets, or type descriptors validated in one step can be mutated by the guest before the host acts on them, driving an out-of-bounds write ([CWE-787]).

Attack Vector

An attacker must first obtain code execution inside a Guest VM running on the affected Qualcomm platform. From that position, the attacker crafts and repeatedly rewrites a message buffer in shared memory used by the host firmware. Racing the host validation logic allows the attacker to corrupt firmware memory. This can escalate privileges outside the guest boundary and undermine hypervisor-enforced isolation on automotive, server, and connectivity SoCs.

No public proof-of-concept exploit or exploitation in the wild has been reported for CVE-2025-21460 at the time of writing.

Detection Methods for CVE-2025-21460

Indicators of Compromise

Unexpected crashes, resets, or watchdog events in Qualcomm host firmware or hypervisor components on the listed SoCs.
Guest VM processes issuing high-frequency writes to shared-memory regions used for host communication.
Kernel or hypervisor logs reporting memory faults during inter-VM message processing.

Detection Strategies

Inventory devices using the affected Qualcomm SoCs and cross-reference installed firmware against the Qualcomm May 2025 Security Bulletin fixed versions.
Monitor Guest VM behavior for anomalous access patterns to shared-memory channels with the host or hypervisor.
Correlate firmware crash telemetry with guest workloads to identify potential exploitation attempts.

Monitoring Recommendations

Enable and centralize firmware, hypervisor, and Guest VM crash logs from automotive head units, gateways, and telematics control units.
Alert on repeated hypervisor faults or Guest VM restarts that follow inter-VM messaging activity.
Track firmware version drift across fleets to confirm patch deployment coverage.

How to Mitigate CVE-2025-21460

Immediate Actions Required

Apply the Qualcomm firmware updates from the Qualcomm May 2025 Security Bulletin to all affected SoCs.
Coordinate with automotive OEMs and device integrators to schedule over-the-air or service-bay firmware updates.
Restrict which workloads can run inside Guest VMs on affected platforms until patches are deployed.

Patch Information

Qualcomm shipped fixes for CVE-2025-21460 as part of the May 2025 Security Bulletin. Downstream vendors, including automotive OEMs and Tier 1 suppliers, must integrate the updated firmware into their release trains and distribute it to end devices. Verify remediation by confirming the running firmware version matches or exceeds the fixed version listed in the Qualcomm advisory for each affected part.

Workarounds

No official workaround is published; the vendor patch is the required remediation.
Reduce exposure by limiting untrusted code execution inside Guest VMs on affected Qualcomm platforms.
Enforce strict validation and isolation of shared-memory channels between Guest VMs and host firmware where configurable.

bash

# Verify firmware version against the Qualcomm May 2025 Security Bulletin
# Replace <component> with the platform-specific query interface exposed by the OEM
fwupdmgr get-devices | grep -i qualcomm
fwupdmgr refresh
fwupdmgr update