High severity · published Sep 24, 2025
CVE-2025-21487
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8017 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8064au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Aqt1000 Firmware · Qualcomm
All versions, or not specified · source: NVD
F6
Fastconnect 6200 Firmware · Qualcomm
All versions, or not specified · source: NVD
F6
Fastconnect 6700 Firmware · Qualcomm
All versions, or not specified · source: NVD
F6
Fastconnect 6800 Firmware · Qualcomm
All versions, or not specified · source: NVD
F6
Fastconnect 6900 Firmware · Qualcomm
All versions, or not specified · source: NVD
F7
Fastconnect 7800 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qam8255p Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qam8295p Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qam8620p Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-21487
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-21487
Vendor Advisory
https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
More from Apq8017 Firmware
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.8
CVE-2023-33063
Use After Free in DSP Services
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability