How to fix CVE-2025-21436?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Is Use After Free affected by CVE-2025-21436?

CVE-2025-21436 presents notable security risk, a use-after-free vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

CVE-2025-21436

HIGH

2025-04-07 [email protected]

7.8

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:35 vuln.today

CVE Published

Apr 07, 2025 - 11:15 nvd

HIGH 7.8

Tags

Use After Free Memory Corruption Buffer Overflow Fastconnect 7800 Firmware Qmp1000 Firmware Sm8735 Firmware Sm8750 Firmware Sm8750p Firmware Snapdragon 8 Gen 3 Mobile Platform Firmware Snapdragon W5 Gen 1 Wearable Platform Firmware Sw5100 Firmware Sw5100p Firmware Sxr2330p Firmware Wcd9378 Firmware Wcd9380 Firmware Wcd9390 Firmware Wcd9395 Firmware Wcn7750 Firmware Wcn7860 Firmware Wcn7861 Firmware Wcn7880 Firmware Wcn7881 Firmware Wsa8830 Firmware Wsa8832 Firmware Wsa8835 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware

Description

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.

Analysis

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical Context

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads. Affected products include: Qualcomm Fastconnect 7800 Firmware, Qualcomm Qmp1000 Firmware, Qualcomm Sm8735 Firmware, Qualcomm Sm8750 Firmware, Qualcomm Sm8750P Firmware.

Affected Products

Qualcomm Fastconnect 7800 Firmware, Qualcomm Qmp1000 Firmware, Qualcomm Sm8735 Firmware, Qualcomm Sm8750 Firmware, Qualcomm Sm8750P Firmware.

Remediation

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +39

POC: 0

CVE-2025-21436 vulnerability details – vuln.today

Back

CVE-2025-21436

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code