GPU Micronode Memory Corruption via Unauthorized Command Execution
CVE-2025-21479 Published on June 3, 2025

Incorrect Authorization in Graphics
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

NVD

Known Exploited Vulnerability

This Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

The following remediation steps are recommended / required by June 24, 2025: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2025-21479 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2025-21479 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2025-21479

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-21479 are published in these products:

Qualcomm Wcd9341 Firmware
 
Qualcomm Wcd9375 Firmware
 
Qualcomm Wcd9378 Firmware
 
Qualcomm Wcd9380 Firmware
 
Qualcomm Wcd9385 Firmware
 
Qualcomm Wcd9390 Firmware
 
Google Android
 
Qualcomm Snapdragon
 

Affected Versions

Qualcomm, Inc. Snapdragon:

Exploit Probability

EPSS
0.11%
Percentile
29.49%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.