Introduction
An attacker can achieve remote code execution on millions of Android devices by sending a specially crafted RTP packet. The flaw behind this, CVE-2025-21483, is in Qualcomm Snapdragon chipsets, which are used in flagship and mid-range smartphones, tablets, automotive systems, and IoT devices worldwide.
About Qualcomm: Qualcomm dominates the mobile semiconductor industry. Its Snapdragon chipsets power a large share of Android devices, with hundreds of millions of units shipped each year. Its products underpin mobile communications and wireless connectivity, and increasingly automotive and IoT applications. A vulnerability in Qualcomm firmware can therefore reach consumer, enterprise, and infrastructure deployments around the world.
Technical information
CVE-2025-21483 is a memory corruption vulnerability caused by improper restriction of operations within the bounds of a memory buffer (CWE-119) in Qualcomm's Data Network Stack and Connectivity components. It is triggered when a user equipment (UE) device receives an RTP (Real-time Transport Protocol) packet from the network. When the firmware reassembles Network Abstraction Layer Units (NALUs), the units used in video streaming protocols such as H.264, H.265, and H.266, it does not properly validate the size and structure of the incoming NALU data.
A malformed or oversized RTP packet can cause a heap-based buffer overflow during NALU reassembly. A remote attacker can use this to corrupt memory and potentially execute arbitrary code at the firmware level. The vulnerability is exploitable over any network interface that processes RTP traffic, including cellular, Wi-Fi, and possibly Bluetooth, depending on device configuration. The attack needs no authentication and no user interaction.
The flaw sits in the low-level firmware of affected Snapdragon chipsets. That firmware runs with high privileges and direct access to system resources, which makes exploitation especially severe, because a successful attack can bypass many OS-level security controls.
Patch information
The September 2025 Android Security Bulletin identified a critical vulnerability in the System component that could allow remote (proximal/adjacent) code execution with no user interaction. The fix was developed and integrated into the Android Open Source Project (AOSP), and it makes three changes:
- Stricter input validation, so that only properly formatted, expected input is processed and malformed data cannot trigger unintended behavior.
- Changes to memory allocation and deallocation that reduce the risk of buffer overflows and memory corruption, both common routes to code execution.
- Stronger permission checks, so that only authorized processes can execute certain functions, which reduces the risk of unauthorized code execution.
The official Android Security Bulletin September 2025 lists every vulnerability addressed that month, with its corresponding patch.
Affected systems and versions
CVE-2025-21483 affects the following Qualcomm platforms and the devices built on them:
- Snapdragon 8 Gen 1
- Snapdragon 8 Gen 2
- Snapdragon 8 Gen 3
- Snapdragon 865
- Snapdragon 870
- Snapdragon 888
- Snapdragon 8+ Gen 1
- Snapdragon 480
- Snapdragon 695
- Snapdragon 780G
- Snapdragon 782G
- FastConnect wireless connectivity solutions
- QCM industrial computing modules
- Automotive SoCs (System on Chips)
Any device configuration that uses one of these chipsets and runs unpatched firmware, or an Android version older than the September 2025 security update, is vulnerable. The attack surface includes smartphones, tablets, automotive infotainment systems, and IoT devices that process RTP traffic for multimedia applications.
Vendor security history
Qualcomm has had critical vulnerabilities in its modem and connectivity firmware before, including in the same RTP and NALU processing logic. The company publishes a monthly security bulletin and coordinates with Android so that patches ship on time. Qualcomm is generally prompt with advisories and patches. Getting those patches to end users is slower. Because the firmware is closed source and every fix has to go through OEM and carrier integration, availability can be delayed, and the complexity of the ecosystem means real-world adoption can lag.
