CVE-2025-21475: Qualcomm Aqt1000 Buffer Overflow Flaw

CVE-2025-21475 Overview

CVE-2025-21475 is a memory corruption vulnerability affecting a wide range of Qualcomm chipsets and firmware components. The flaw occurs while processing an escape code when a DisplayId parameter is passed with a large unsigned value. A local attacker with low privileges can trigger the condition to corrupt kernel or driver memory. Qualcomm addressed the issue in its May 2025 Security Bulletin. The vulnerability maps to [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read).

Critical Impact
Successful exploitation can lead to memory corruption impacting confidentiality, integrity, and availability on affected Qualcomm-based devices, including Snapdragon Compute platforms, FastConnect Wi-Fi/Bluetooth modules, and multiple audio and connectivity firmware components.

Affected Products

Qualcomm FastConnect 6200/6700/6800/6900/7800 firmware
Qualcomm Snapdragon 7c, 7c Gen 2, and 7c+ Gen 3 Compute platforms
Qualcomm QCM/QCS 5430/6490, QCA6391/6420/6430, WCD93xx, and WSA88xx firmware families

Discovery Timeline

2025-05-06 - CVE-2025-21475 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21475

Vulnerability Analysis

The vulnerability resides in the escape-code processing path of a Qualcomm display or graphics driver component. When a caller supplies a DisplayId parameter carrying a very large unsigned value, the driver fails to correctly validate the value before using it in memory access calculations. The result is memory corruption stemming from an out-of-bounds read pattern classified as [CWE-125] and [CWE-126].

Because the affected code path is exposed through a local driver interface, a low-privileged application on the device can invoke it. Successful exploitation impacts confidentiality, integrity, and availability of the affected system. The wide reach across FastConnect, Snapdragon Compute, WCD audio codecs, and WSA smart speaker amplifier firmware means the same defect surfaces across mobile, laptop, and embedded platforms shipping Qualcomm silicon.

Root Cause

The root cause is missing or insufficient bounds validation on the DisplayId argument passed through an escape code (a driver-specific command channel commonly reached via IOCTL-style entry points). When DisplayId is treated as an unsigned index into an internal structure or array without a size check, oversized values drive the driver to read memory beyond the intended buffer, producing corruption in adjacent kernel or driver structures.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. A malicious application installed on an affected device invokes the vulnerable driver interface with a crafted escape-code request containing an oversized DisplayId. See the Qualcomm May 2025 Security Bulletin for authoritative details on the affected components and fixed versions. No public proof-of-concept exploit or CISA KEV listing is currently associated with this CVE.

// No verified exploit code is available for CVE-2025-21475.
// Conceptually: a local caller issues a driver escape command
// with a crafted DisplayId of a large unsigned value, which
// bypasses bounds checks in the escape-code handler and
// triggers an out-of-bounds memory access.

Detection Methods for CVE-2025-21475

Indicators of Compromise

Unexpected kernel or driver crashes, panics, or watchdog resets referencing display, graphics, or Qualcomm escape-code handling routines.
Repeated IOCTL or escape-code calls from untrusted user-space applications targeting display or graphics drivers with anomalously large parameter values.
Newly installed or sideloaded applications making low-level driver calls uncharacteristic of their declared functionality.

Detection Strategies

Monitor device logs (dmesg, logcat, vendor RIL/HAL logs) for repeated segmentation faults or use-after-free style traces originating from Qualcomm display or graphics kernel modules.
Baseline expected driver interactions per application and alert on outliers invoking escape-code paths with atypical arguments.
Correlate crash telemetry with process ancestry to identify user-space applications repeatedly triggering driver faults.

Monitoring Recommendations

Ingest mobile device management (MDM) and endpoint telemetry into a centralized analytics platform to track patch level of Qualcomm firmware across the fleet.
Track vendor patch level fields (for example, ro.build.version.security_patch on Android) and flag devices not on the May 2025 (or later) Qualcomm patch level.
Alert on kernel oops or panic events referencing display driver escape-code handlers.

How to Mitigate CVE-2025-21475

Immediate Actions Required

Inventory devices containing the affected Qualcomm chipsets and firmware components listed in the Qualcomm May 2025 Security Bulletin.
Apply the vendor security patch shipped by the device OEM containing the fixed Qualcomm firmware.
Restrict installation of untrusted applications on affected devices until patches are deployed.
Enforce application allow-listing and least privilege on managed endpoints.

Patch Information

Qualcomm published fixes in the May 2025 Security Bulletin. The patches must reach devices through OEM firmware and OS updates. Confirm your device manufacturer has issued a build that includes the May 2025 (or later) Qualcomm security patch level for every affected chipset and companion component in your inventory.

Workarounds

No official vendor workaround is documented; patching remains the primary remediation.
Reduce exposure by limiting sideloaded or unvetted applications that can invoke local driver interfaces.
Enable OS-level exploit mitigations and keep MDM-enforced security baselines applied.

bash

# Example: check Android security patch level on managed devices
adb shell getprop ro.build.version.security_patch
# Confirm value is 2025-05-01 or later for devices with affected Qualcomm components