CVE-2025-21424
Published: 03 March 2025
Description
Memory corruption while calling the NPU driver APIs concurrently.
Security Summary
CVE-2025-21424 is a memory corruption vulnerability classified under CWE-416 (use-after-free), triggered by concurrent calls to NPU driver APIs. It affects Qualcomm's NPU driver components, with a CVSS v3.1 base score of 7.8 (High). The issue was publicly disclosed on March 3, 2025, via Qualcomm's security bulletin.
A local attacker with low privileges (PR:L) can exploit this vulnerability through low-complexity attacks (AC:L) requiring no user interaction (UI:N). Exploitation enables high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to full device compromise within the unchanged security scope (S:U).
Mitigation details, including affected products and patching guidance, are outlined in Qualcomm's March 2025 security bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html.
Details
- CWE(s)