VMware ESXi Guest VM Controlled Buffer Memory Corruption
CVE-2025-21460 Published on May 6, 2025
Improper Input Validation in Automotive Software platform based on QNX
Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.
Vulnerability Analysis
CVE-2025-21460 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2025-21460
stack.watch emails you whenever new vulnerabilities are published in VMware ESXi or Qualcomm Snapdragon. Just hit a watch button to start following.
Affected Versions
Qualcomm, Inc. Snapdragon:- Version QAM8255P is affected.
- Version QAM8295P is affected.
- Version QAM8620P is affected.
- Version QAM8650P is affected.
- Version QAM8775P is affected.
- Version QAMSRV1H is affected.
- Version QAMSRV1M is affected.
- Version QCA6574A is affected.
- Version QCA6574AU is affected.
- Version QCA6595 is affected.
- Version QCA6595AU is affected.
- Version QCA6688AQ is affected.
- Version QCA6696 is affected.
- Version QCA6698AQ is affected.
- Version SA6145P is affected.
- Version SA6150P is affected.
- Version SA6155 is affected.
- Version SA6155P is affected.
- Version SA7255P is affected.
- Version SA7775P is affected.
- Version SA8145P is affected.
- Version SA8150P is affected.
- Version SA8155 is affected.
- Version SA8155P is affected.
- Version SA8195P is affected.
- Version SA8255P is affected.
- Version SA8295P is affected.
- Version SA8540P is affected.
- Version SA8620P is affected.
- Version SA8650P is affected.
- Version SA8770P is affected.
- Version SA8775P is affected.
- Version SA9000P is affected.
- Version SRV1H is affected.
- Version SRV1L is affected.
- Version SRV1M is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.