CVE-2025-21479
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Description
CVE-2025-21479 is a high-severity incorrect authorization vulnerability affecting multiple Qualcomm chipsets, including the Snapdragon and FastConnect product families. The flaw resides in the GPU micronode, where an attacker can trigger unauthorized command execution through a specific sequence of GPU commands, leading to memory corruption. With a CVSS v3.1 base score of 8.6 and a severity rating of HIGH, successful exploitation could grant an attacker elevated privileges across system boundaries, compromising the confidentiality, integrity, and availability of the affected device. CISA has added CVE-2025-21479 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 24, 2025, indicating confirmed active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | aqt1000 firmware | - |
| qualcomm | fastconnect 6200 firmware | - |
| qualcomm | fastconnect 6700 firmware | - |
| qualcomm | fastconnect 6900 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | fastconnect 6800 firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qcm4490 firmware | - |
| qualcomm | qcs4490 firmware | - |
| qualcomm | sd855 firmware | - |
| qualcomm | sm4635 firmware | - |
| qualcomm | sm6250 firmware | - |
| qualcomm | sm6650 firmware | - |
| qualcomm | sm6650p firmware | - |
| qualcomm | sm7325p firmware | - |
| qualcomm | sm7635 firmware | - |
| qualcomm | sm7675 firmware | - |
| qualcomm | sm7675p firmware | - |
| qualcomm | sm8550p firmware | - |
| qualcomm | sm8635 firmware | - |
References
Weakness Type
CWE-863: Incorrect Authorization
CVE-2025-21479 is classified under CWE-863 (Incorrect Authorization), which occurs when a product performs an authorization check that is implemented incorrectly, allowing actors to bypass intended access controls. In the context of Qualcomm GPU micronodes, the authorization check governing command execution fails to properly validate the sequence and privileges of GPU commands, enabling unauthorized operations that lead to memory corruption and potential code execution.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2025-21479 presents significant impact across all three dimensions of the CIA triad. The vulnerability is locally exploitable (AV:L) with low attack complexity (AC:L), requiring no authentication (PR:N) but some user interaction (UI:R). Critically, the scope is changed (S:C), meaning exploitation can affect resources beyond the vulnerable GPU component, potentially impacting the entire device operating system and applications. Confidentiality (High): An attacker can read sensitive data from memory regions they should not have access to, including cryptographic keys, authentication tokens, and personal user data. Integrity (High): Memory corruption enables modification of data structures and code, potentially allowing persistent backdoor installation or security control bypass. Availability (High): The memory corruption can crash the device or render it unusable. Although the EPSS score of 0.097% at the 26.84th percentile suggests exploitation probability is relatively low in automated campaigns, the confirmed KEV listing indicates targeted exploitation is already occurring.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-21479 by adding it to the Known Exploited Vulnerabilities catalog, indicating that threat actors are actively targeting this Qualcomm GPU vulnerability in real-world attacks. The EPSS score of 0.097% at the 26.84th percentile suggests that while automated mass exploitation is not yet widespread, the vulnerability is being used in targeted campaigns—consistent with the sophisticated nature of mobile chipset exploits. No public exploit code or proof-of-concept has been identified in the available references, which aligns with the pattern of mobile vulnerability exploitation by advanced threat actors who typically keep their exploits private to maintain operational advantage.
Remediation
-
Apply vendor patches immediately. Install the security updates referenced in the Qualcomm June 2025 Security Bulletin. Contact your device manufacturer (OEM) for firmware updates that incorporate the Qualcomm patch for the affected chipsets including Snapdragon SM7675, SM8550P, SM6650, FastConnect 6200/6700/6800/6900/7800, and others.
-
Verify firmware versions on all deployed devices using affected Qualcomm chipsets. Maintain an inventory of devices with vulnerable GPU micronode firmware and prioritize patching based on exposure and criticality.
-
Restrict installation of untrusted applications on affected devices, as the vulnerability requires local access with user interaction. Enforce enterprise mobile device management (MDM) policies that prevent sideloading and restrict app sources to vetted application stores.
-
Monitor device behavior for signs of compromise, including unexpected GPU crashes, abnormal memory usage, device instability, or unauthorized application activity. Review device logs for indicators of GPU command injection attempts.
-
Implement defense-in-depth measures by enabling all available platform security features including SELinux enforcement, verified boot, and runtime memory protections (ASLR, stack canaries) to increase the difficulty of successful exploitation.
Technical Details
CVE-2025-21479 is an incorrect authorization vulnerability in the Qualcomm GPU micronode that manifests during the execution of specific sequences of GPU commands. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicates local exploitation with changed scope, meaning the GPU component vulnerability can impact the broader device security context. The flaw occurs because the GPU micronode's command processing logic fails to correctly authorize certain command sequences, allowing an attacker to execute commands that should be restricted. This incorrect authorization leads to memory corruption within the GPU subsystem, which can then be leveraged to affect the host system due to the shared memory architecture between the GPU and CPU. The vulnerability affects a wide range of Qualcomm chipsets including AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, SD855, and multiple SM-series processors, indicating the flawed authorization logic exists in a shared GPU driver component used across Qualcomm's product portfolio.
Frequently Asked Questions
Is CVE-2025-21479 being actively exploited?
Yes. CISA has added CVE-2025-21479 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The remediation deadline is June 24, 2025, and organizations should prioritize patching immediately.
What products are affected by CVE-2025-21479?
CVE-2025-21479 affects a broad range of Qualcomm chipsets including AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, SD855, SM4635, SM6250, SM6650, SM6650P, SM7325P, SM7635, SM7675, SM7675P, SM8550P, and SM8635. Devices from multiple manufacturers using these chipsets may be vulnerable.
How do I fix CVE-2025-21479?
Apply the security patches described in the Qualcomm June 2025 Security Bulletin. Contact your device OEM for firmware updates incorporating the Qualcomm fix. In the interim, restrict untrusted application installation and enforce strict MDM policies on affected devices.
How severe is CVE-2025-21479?
CVE-2025-21479 has a CVSS v3.1 base score of 8.6 (HIGH severity). The vulnerability has changed scope, meaning exploitation of the GPU component can impact the entire device. While the EPSS score of 0.097% indicates limited automated exploitation, the KEV listing confirms targeted attacks are occurring.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.