{"id":"CVE-2025-21428","aliases":["EUVD-2025-10002","GHSA-4rmv-m7cx-wvg4"],"status":"published","title":"Buffer Over-read in WLAN Host","description":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00263,"percentile":0.18281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-126"],"published":"2025-04-07T10:15:55Z","modified":"2026-11-03T22:02:54Z","products":[{"vendor":"qualcomm","product":"9206_lte_modem_firmware"},{"vendor":"qualcomm","product":"apq8017_firmware"},{"vendor":"qualcomm","product":"ar8031_firmware"},{"vendor":"qualcomm","product":"c-v2x_9150_firmware"},{"vendor":"qualcomm","product":"csra6620_firmware"},{"vendor":"qualcomm","product":"csra6640_firmware"},{"vendor":"qualcomm","product":"fastconnect_6200_firmware"},{"vendor":"qualcomm","product":"fastconnect_6900_firmware"},{"vendor":"qualcomm","product":"mdm9250_firmware"},{"vendor":"qualcomm","product":"mdm9628_firmware"},{"vendor":"qualcomm","product":"mdm9640_firmware"},{"vendor":"qualcomm","product":"mdm9650_firmware"},{"vendor":"qualcomm","product":"msm8996au_firmware"},{"vendor":"qualcomm","product":"qca6174_firmware"},{"vendor":"qualcomm","product":"qca6174a_firmware"},{"vendor":"qualcomm","product":"qca6175a_firmware"},{"vendor":"qualcomm","product":"qca6554a_firmware"},{"vendor":"qualcomm","product":"qca6564a_firmware"},{"vendor":"qualcomm","product":"qca6564au_firmware"},{"vendor":"qualcomm","product":"qca6574_firmware"},{"vendor":"qualcomm","product":"qca6574a_firmware"},{"vendor":"qualcomm","product":"qca6574au_firmware"},{"vendor":"qualcomm","product":"qca6584_firmware"},{"vendor":"qualcomm","product":"qca6584au_firmware"},{"vendor":"qualcomm","product":"qca6595_firmware"},{"vendor":"qualcomm","product":"qca6595au_firmware"},{"vendor":"qualcomm","product":"qca6696_firmware"},{"vendor":"qualcomm","product":"qca9367_firmware"},{"vendor":"qualcomm","product":"qca9377_firmware"},{"vendor":"qualcomm","product":"qca9379_firmware"},{"vendor":"qualcomm","product":"qcm2150_firmware"},{"vendor":"qualcomm","product":"qep8111_firmware"},{"vendor":"qualcomm","product":"qualcomm_205_mobile_platform_firmware"},{"vendor":"qualcomm","product":"qualcomm_215_mobile_platform_firmware"},{"vendor":"qualcomm","product":"sa2150p_firmware"},{"vendor":"qualcomm","product":"sd626_firmware"},{"vendor":"qualcomm","product":"sdm429w_firmware"},{"vendor":"qualcomm","product":"smart_audio_200_platform_firmware"},{"vendor":"qualcomm","product":"smart_audio_400_platform_firmware"},{"vendor":"qualcomm","product":"smart_display_200_platform_\\(apq5053-aa\\)_firmware"},{"vendor":"qualcomm","product":"snapdragon_1200_wearable_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_210_processor_firmware"},{"vendor":"qualcomm","product":"snapdragon_212_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_425_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_429_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_439_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_625_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_626_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_632_mobile_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_820_automotive_platform_firmware"},{"vendor":"qualcomm","product":"snapdragon_auto_5g_modem-rf_firmware"},{"vendor":"qualcomm","product":"snapdragon_x12_lte_modem_firmware"},{"vendor":"qualcomm","product":"snapdragon_x35_5g_modem-rf_system_firmware"},{"vendor":"qualcomm","product":"snapdragon_x5_lte_modem_firmware"},{"vendor":"qualcomm","product":"vision_intelligence_100_platform_\\(apq8053-aa\\)_firmware"},{"vendor":"qualcomm","product":"vision_intelligence_200_platform_\\(apq8053-ac\\)_firmware"},{"vendor":"qualcomm","product":"wcd9326_firmware"},{"vendor":"qualcomm","product":"wcd9330_firmware"},{"vendor":"qualcomm","product":"wcd9335_firmware"},{"vendor":"qualcomm","product":"wcd9340_firmware"},{"vendor":"qualcomm","product":"wcn3610_firmware"},{"vendor":"qualcomm","product":"wcn3615_firmware"},{"vendor":"qualcomm","product":"wcn3620_firmware"},{"vendor":"qualcomm","product":"wcn3660b_firmware"},{"vendor":"qualcomm","product":"wcn3680_firmware"},{"vendor":"qualcomm","product":"wcn3680b_firmware"},{"vendor":"qualcomm","product":"wcn3980_firmware"},{"vendor":"qualcomm","product":"wsa8810_firmware"},{"vendor":"qualcomm","product":"wsa8815_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon"}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21428"},{"url":"https://github.com/advisories/GHSA-4rmv-m7cx-wvg4"}],"sources":{"cve":[{"id":"CVE-2025-21428","title":"Buffer Over-read in WLAN Host","description":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","status":"published","published":"2025-04-07T10:15:55.243Z","modified":"2026-11-03T22:02:54.676Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-03T23:33:08.294318Z"}],"euvd":[{"id":"EUVD-2025-10002","description":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","status":"published","published":"2025-04-07T10:15:55Z","modified":"2026-11-03T22:02:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T23:01:35.361827Z"}],"ghsa":[{"id":"GHSA-4rmv-m7cx-wvg4","title":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from...","description":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","status":"published","published":"2025-04-07T12:33:18Z","modified":"2025-04-07T12:33:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:00:49.48461Z"}],"nvd":[{"id":"CVE-2025-21428","description":"Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.","status":"published","published":"2025-04-07T11:15:50.87Z","modified":"2026-06-17T08:43:22.313Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:10:59.48027Z"}]}}