What is the CVSS score of CVE-2025-21486?

CVE-2025-21486 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wcn7860 Firmware are affected by CVE-2025-21486?

CVE-2025-21486 is a high-severity memory corruption vulnerability affecting dynamic process creation that could allow attackers to crash systems or execute arbitrary code.

How to fix or mitigate CVE-2025-21486?

Within 24 hours: Inventory all systems running affected software and assess exposure in production environments. Within 7 days: Implement network segmentation to restrict access to affected services and disable dynamic process creation features if operationally feasible. Within 30 days: Establish daily monitoring for vendor patch release and prepare deployment procedures; maintain heightened logging of process creation events.

Wcn7860 Firmware CVE-2025-21486

EUVD-2025-16703 HIGH

Untrusted Pointer Dereference (CWE-822)

2025-06-03 product-security@qualcomm.com

Buffer Overflow Memory Corruption Denial Of Service Wcn7860 Firmware Sm8750 Firmware Wcn3680b Firmware Wsa8835 Firmware Wsa8832 Firmware Wcn7750 Firmware Wsa8840 Firmware Wcd9395 Firmware Wsa8845h Firmware Wsa8830 Firmware Wsa8845 Firmware Sw5100 Firmware Wcd9378 Firmware Wcn7880 Firmware Fastconnect 6900 Firmware Wcd9385 Firmware Sxr2330p Firmware Wcn7881 Firmware Wcd9380 Firmware Wcn7861 Firmware Wcn3988 Firmware Sxr2250p Firmware Sxr2230p Firmware Wcn3660b Firmware Wcn3980 Firmware Sm8735 Firmware Sw5100p Firmware Fastconnect 7800 Firmware Qmp1000 Firmware Sm8750p Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16703

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 7.8

DescriptionCVE.org

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

AnalysisAI

Memory corruption vulnerability in dynamic process creation functionality that occurs when a client passes only the address and length of a shell binary without proper validation or bounds checking. This vulnerability affects local attackers with limited user privileges who can exploit the memory corruption to achieve arbitrary code execution with full system impact (confidentiality, integrity, and availability compromise). The vulnerability requires local access and low complexity exploitation, making it a significant risk for multi-user systems; KEV and active exploitation status are not confirmed in available data, but the high CVSS score (7.8) and memory corruption nature suggest this warrants urgent patching.

Technical ContextAI

This vulnerability exists in process creation APIs/syscalls that dynamically invoke shell binaries based on client-supplied parameters. The root cause is classified under CWE-822 (Improperly Controlled Object Before It Is Freed/'Use Before Free'), indicating improper memory management during the transition from user-mode client data to kernel-mode process execution. The flaw occurs because the system accepts only an address and length parameter for the shell binary without: (1) validating that the memory region remains valid and accessible throughout the operation, (2) performing bounds checking on the supplied length, or (3) properly synchronizing access to prevent use-after-free conditions. This is typical of systems that perform direct memory operations in privileged contexts based on unprivileged user input, particularly in process spawning routines where the kernel must reference user-supplied binary data. The vulnerability likely affects Unix-like systems with dynamic process creation capabilities (fork/exec patterns or equivalent syscalls).

RemediationAI

Immediate remediation steps: (1) Apply security patches from your OS/product vendor when available—search vendor security advisories for CVE-2025-21486 specific patch versions and apply without delay; (2) Implement kernel/firmware updates from official sources; (3) For systems where patches are not yet available, implement access controls restricting use of dynamic process creation APIs to trusted users only (via SELinux, AppArmor, or capability-based security). Workarounds include: (1) Disabling non-essential process spawning features if application logic permits, (2) Running vulnerable services in restricted containers with reduced privilege sets, (3) Monitoring process creation syscalls for suspicious patterns via auditd/ebpf monitoring. Long-term: enable kernel address space layout randomization (ASLR), stack canaries, and execute-never (NX) protections to increase exploitation complexity. Subscribe to your vendor's security mailing lists for patch notification. Without specific vendor advisory links in provided data, consult official CVE databases (nvd.nist.gov, cisa.gov) and vendor security pages for patch download URLs and version information.