CVE-2025-21480
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Description
CVE-2025-21480 is a high-severity incorrect authorization vulnerability in the GPU micronode of multiple Qualcomm chipsets that enables memory corruption through unauthorized command execution. Similar to CVE-2025-21479, this flaw allows an attacker to execute a specific sequence of GPU commands that bypass authorization controls, leading to arbitrary memory corruption on the affected device. Rated with a CVSS v3.1 score of 8.6 (HIGH), the vulnerability affects chipsets including Snapdragon, FastConnect, and SC8380XP series processors. CISA has confirmed active exploitation by adding CVE-2025-21480 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 24, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | aqt1000 firmware | - |
| qualcomm | fastconnect 6200 firmware | - |
| qualcomm | fastconnect 6700 firmware | - |
| qualcomm | fastconnect 6800 firmware | - |
| qualcomm | fastconnect 6900 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qcm4490 firmware | - |
| qualcomm | qcs4490 firmware | - |
| qualcomm | sc8380xp firmware | - |
| qualcomm | sd855 firmware | - |
| qualcomm | sm4635 firmware | - |
| qualcomm | sm6250 firmware | - |
| qualcomm | sm6650 firmware | - |
| qualcomm | sm6650p firmware | - |
| qualcomm | sm7325p firmware | - |
| qualcomm | sm7635 firmware | - |
| qualcomm | sm7675 firmware | - |
| qualcomm | sm7675p firmware | - |
| qualcomm | sm8550p firmware | - |
References
Weakness Type
CWE-863: Incorrect Authorization
CVE-2025-21480 falls under CWE-863 (Incorrect Authorization), a weakness where an authorization check exists but is incorrectly implemented. In Qualcomm's GPU micronode, the command authorization mechanism fails to properly validate certain command sequences, allowing unauthorized operations that should be restricted. This incorrect authorization directly enables the memory corruption condition that characterizes this vulnerability.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
The impact of CVE-2025-21480 is severe, with the CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicating high impact across confidentiality, integrity, and availability with changed scope. The local attack vector (AV:L) requires an attacker to have local access to the device, but no privileges (PR:N) are needed beyond minimal user interaction (UI:R), such as opening a malicious application or file. The changed scope (S:C) is particularly concerning as it means the GPU vulnerability can be leveraged to compromise the broader system, including the operating system kernel and all applications. Confidentiality, integrity, and availability are all rated HIGH, meaning an attacker could read sensitive data from memory, modify system data and code, and crash or disable the device. The EPSS score of 1.52% at the 81st percentile indicates a notably higher exploitation probability compared to the related CVE-2025-21479.
Exploit Maturity
CVE-2025-21480 has been confirmed as actively exploited, with CISA adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 1.52% at the 81st percentile places this vulnerability in the top 19% of all CVEs by exploitation probability, indicating significant real-world exploitation activity. No public proof-of-concept exploit code has been identified in the available references, suggesting that exploitation is being conducted by sophisticated threat actors with proprietary exploit capabilities. This is typical for mobile chipset vulnerabilities, which are often exploited by state-sponsored groups or commercial surveillance vendors targeting specific individuals or organizations.
Remediation
-
Apply Qualcomm security patches immediately. Refer to the Qualcomm June 2025 Security Bulletin for the specific fix. Work with your device OEM to obtain firmware updates that incorporate the patch for affected chipsets including SC8380XP, FastConnect 6200/6700/6800/6900/7800, SM7675, SM8550P, and others.
-
Prioritize devices with SC8380XP chipsets, as this chipset is unique to CVE-2025-21480 (not present in CVE-2025-21479), suggesting a broader GPU driver surface is affected.
-
Enforce application control policies on managed devices to prevent execution of untrusted applications. Since exploitation requires local access and user interaction, blocking untrusted app installation significantly reduces the attack surface.
-
Conduct forensic review on devices suspected of compromise. Look for indicators such as abnormal GPU driver behavior, unexpected process creation, unauthorized data exfiltration, or anomalous network connections from mobile devices.
-
Implement network-level monitoring for affected devices, including traffic analysis to detect potential command-and-control communications or data exfiltration from compromised mobile endpoints.
Technical Details
CVE-2025-21480 is an incorrect authorization vulnerability in the GPU micronode component of multiple Qualcomm chipsets. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a local attack with low complexity, no privileges required, and changed scope with maximum impact across all three CIA dimensions. The vulnerability mechanism involves the GPU micronode's failure to correctly authorize a specific sequence of commands, which allows an attacker to trigger unauthorized command execution leading to memory corruption. The GPU micronode serves as a co-processor that handles graphics rendering and compute operations, and its close integration with system memory means that memory corruption in the GPU context can be leveraged to affect the host CPU's memory space. The affected chipsets include AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, SC8380XP, SD855, and numerous SM-series processors, with the SC8380XP being notably included only in this CVE.
Frequently Asked Questions
Is CVE-2025-21480 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-21480 by adding it to the Known Exploited Vulnerabilities catalog. Organizations must apply patches before the June 24, 2025 remediation deadline.
What products are affected by CVE-2025-21480?
CVE-2025-21480 affects Qualcomm chipsets including AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, SC8380XP, SD855, SM4635, SM6250, SM6650, SM6650P, SM7325P, SM7635, SM7675, SM7675P, and SM8550P. Devices from various manufacturers using these processors may be vulnerable.
How do I fix CVE-2025-21480?
Install firmware updates from your device manufacturer that incorporate the Qualcomm June 2025 Security Bulletin patches. Until patched, restrict untrusted application installation and enforce mobile device management policies to reduce exposure.
How severe is CVE-2025-21480?
CVE-2025-21480 carries a CVSS v3.1 score of 8.6 (HIGH). The changed scope rating means exploitation can impact the entire device beyond the vulnerable GPU component. The EPSS score of 1.52% at the 81st percentile indicates significant exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.