CVE Alert: CVE-2025-21484 – Qualcomm, Inc. – Snapdragon
CVE-2025-21484
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
AI Summary Analysis
Risk verdict
High risk of remote information disclosure via the Qualcomm Snapdragon data network stack; no user interaction required, so exposure is scalable across network-connected devices.
Why this matters
The flaw enables an attacker to read memory contents by manipulating RTP traffic, potentially exposing sensitive data across mobile, automotive, IoT and other Snapdragon-enabled platforms. In practice, this could support targeted data exfiltration or reconnaissance across devices in enterprise or consumer environments.
Most likely attack path
An attacker ships crafted RTP streams to vulnerable devices over the network to trigger a buffer over-read. With privileges required being none and user interaction not needed, exploitation could occur at scale where RTP is processed during normal media delivery, subject to the victim device’s scope and network exposure.
Who is most exposed
Any deployment with exposed RTP-enabled network services on Snapdragon-based platforms—mobile, automotive, IoT, wearables and related connectivity stacks—across consumer and industrial environments.
Detection ideas
- Monitor for abnormal RTP fragmentation/reassembly errors and unusual memory access patterns in runtime logs.
- Look for spikes in memory-read indicators or device reboots/crashes tied to RTP processing.
- Correlate network traffic to identify floods or crafted RTP streams targeting Snapdragon-enabled endpoints.
- Instrument RTP handling modules for boundary checks and unusual payload sizes.
- Validate vendor advisories and firmware telemetry for unexpected RTP-related exceptions.
Mitigation and prioritisation
- Apply vendor security bulletin updates and deploy patched firmware where available; prioritise vulnerable device classes.
- Implement network controls to restrict RTP access to trusted segments and devices; segment vulnerable endpoints from sensitive assets.
- Disable or harden RTP fragmentation/reassembly pathways if feasible; enforce strict input validation at network edge.
- Develop compensating controls and test patches in staging before broader rollout; track progress in change-management records.
- If KEV is present or EPSS ≥ 0.5, treat as priority 1; otherwise, prioritise promptly given the network-exposed, high-impact nature.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
