CVE-2025-21467: Qualcomm Csra6620 Use-After-Free Flaw

CVE-2025-21467 Overview

CVE-2025-21467 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw occurs while reading the firmware (FW) response from the shared queue used for host-to-firmware communication. Qualcomm disclosed the issue in the May 2025 Security Bulletin. The weakness is classified as an out-of-bounds write [CWE-787] and impacts confidentiality, integrity, and availability on affected devices. Exploitation requires local access and low privileges, but no user interaction. Affected products span Snapdragon mobile, automotive, wearable, XR, modem, audio codec, and FastConnect Wi-Fi/Bluetooth platforms shipped in devices worldwide.

Critical Impact
A local, low-privileged attacker can trigger memory corruption in Qualcomm firmware handling of shared-queue responses, leading to potential code execution or denial of service across dozens of Snapdragon and related platforms.

Affected Products

Qualcomm Snapdragon mobile SoCs including Snapdragon 8 Gen 1, 8 Gen 3, 8+ Gen 1, 888/888+, 865/865+, 870, 765/765G, 750G, 690, 685, 680, 662, 660, and 460
Qualcomm FastConnect 6200, 6700, 6800, 6900, 7800 and Snapdragon XR2 5G, XR2+ Gen 1, W5+ Gen 1, and Auto 5G Modem-RF platforms
Qualcomm automotive, IoT, and audio components including SA8155P, SA8195P, SA8295P, QCA6xxx family, WCD9xxx audio codecs, and WSA88xx smart speaker amplifiers

Discovery Timeline

2025-05-06 - CVE-2025-21467 published to NVD following inclusion in the Qualcomm May 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21467

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] that occurs while the firmware reads a response from a shared queue. Shared queues are commonly used to pass messages between the application processor and coprocessors such as the modem, DSP, Wi-Fi, or audio subsystem. When response data is dequeued and parsed, insufficient validation of length or offset fields allows a write outside the intended buffer boundary. This corrupts adjacent memory in the firmware address space and can lead to arbitrary code execution within the affected subsystem or a hard crash of the device.

Exploitation is scoped to local attack vectors and requires low privileges. Since firmware components often run with elevated privilege compared to userspace processes, a successful exploit can escalate impact beyond the initial context. The Qualcomm advisory confirms high impact to confidentiality, integrity, and availability.

Root Cause

The root cause is missing or incorrect bounds validation when the firmware consumes a response frame from the shared queue. Attacker-influenced fields such as payload length or index values are used in write operations without verification against the destination buffer size. This aligns with the CWE-787 classification for out-of-bounds writes.

Attack Vector

A local attacker with the ability to send or influence messages routed through the shared queue interface can craft a malformed response structure. When the firmware processes the crafted entry, the parser writes past the buffer boundary. The vulnerability requires no user interaction and no additional authentication beyond low local privilege. See the Qualcomm May 2025 Security Bulletin for advisory details.

// No verified public exploit code is available.
// Refer to the Qualcomm May 2025 Security Bulletin for advisory details.

Detection Methods for CVE-2025-21467

Indicators of Compromise

Unexpected subsystem restarts or kernel logs referencing modem, WLAN, ADSP, or SLPI crashes tied to shared-queue message handling
Repeated firmware ramdumps or SSR (subsystem restart) events following the delivery of malformed IPC messages
Anomalous processes with low privileges interacting with QMI, SMEM, or shared-memory queue interfaces

Detection Strategies

Correlate device crash telemetry with process activity to identify low-privileged apps that consistently precede firmware faults
Monitor mobile device management (MDM) logs for devices reporting firmware versions predating the Qualcomm May 2025 patch level
Baseline normal IPC and shared-queue message rates and alert on unusually large or malformed payloads observed at the host boundary

Monitoring Recommendations

Track Android security patch levels across the fleet and flag devices missing the May 2025 Qualcomm patch
Ingest mobile OEM crash reports and subsystem restart events into a central logging pipeline for review
Watch vendor advisories at the Qualcomm May 2025 Security Bulletin for updated component lists and downstream OEM firmware releases

How to Mitigate CVE-2025-21467

Immediate Actions Required

Apply the OEM firmware update that incorporates the Qualcomm May 2025 patch on all affected Snapdragon, FastConnect, QCA, WCD, and WSA components
Inventory devices using the affected chipsets listed in the Qualcomm bulletin and prioritize patch deployment to high-value assets
Restrict installation of untrusted third-party applications that could interact with vulnerable firmware interfaces on managed devices

Patch Information

Qualcomm released fixes as part of its May 2025 Security Bulletin. Device manufacturers must integrate the updated firmware into their monthly security patches. Users should install the latest available OEM update that includes the May 2025 or later Android security patch level. Full details are available in the Qualcomm May 2025 Security Bulletin.

Workarounds

No official workarounds are published; apply vendor firmware updates as the primary remediation
Enforce MDM policies that block sideloading and limit application permissions to reduce local attack surface until patches are available
Decommission or isolate end-of-life devices where the OEM will not deliver a firmware update containing the fix

bash

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch

# Confirm the value is 2025-05-01 or later before considering a device patched