CVE-2025-21479

Published Jun 3, 2025

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-21479 is an incorrect authorization vulnerability found in the Graphics component of Qualcomm's Adreno GPU driver. This flaw can lead to memory corruption due to unauthorized command execution in the GPU microcode when a specific sequence of commands is processed. Successful exploitation of CVE-2025-21479 could allow attackers to execute unauthorized commands, potentially corrupting system memory. Qualcomm has released patches for this vulnerability and recommends that OEMs deploy the updates to affected devices as soon as possible. There are indications that this vulnerability may be under limited, targeted exploitation.

Description
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Source
product-security@qualcomm.com
NVD status
Analyzed
Products
aqt1000_firmware, fastconnect_6200_firmware, fastconnect_6700_firmware, fastconnect_6900_firmware, fastconnect_7800_firmware, fastconnect_6800_firmware, qca6391_firmware, qcm4490_firmware, qcs4490_firmware, sd855_firmware, sm4635_firmware, sm6250_firmware, sm6650_firmware, sm6650p_firmware, sm7325p_firmware, sm7635_firmware, sm7675_firmware, sm7675p_firmware, sm8550p_firmware, sm8635_firmware, sm8635p_firmware, sm8650q_firmware, snapdragon_4_gen_1_mobile_platform_firmware, snapdragon_460_mobile_platform_firmware, snapdragon_480_5g_mobile_platform_firmware, snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)_firmware, snapdragon_662_mobile_platform_firmware, snapdragon_680_4g_mobile_platform_firmware, snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware, snapdragon_690_5g_mobile_platform_firmware, snapdragon_695_5g_mobile_platform_firmware, snapdragon_720g_mobile_platform_firmware, snapdragon_778g_5g_mobile_platform_firmware, snapdragon_778g\+_5g_mobile_platform_\(sm7325-ae\)_firmware, snapdragon_782g_mobile_platform_\(sm7325-af\)_firmware, snapdragon_7c\+_gen_3_compute_firmware, snapdragon_8_gen_2_mobile_platform_firmware, snapdragon_8_gen_3_mobile_platform_firmware, snapdragon_8\+_gen_2_mobile_platform_firmware, snapdragon_855_mobile_platform_firmware, snapdragon_855\+\/860_mobile_platform_\(sm8150-ac\)_firmware, snapdragon_865_5g_mobile_platform_firmware, snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\)_firmware, snapdragon_870_5g_mobile_platform_\(sm8250-ac\)_firmware, snapdragon_888_5g_mobile_platform_firmware, snapdragon_888\+_5g_mobile_platform_\(sm8350-ac\)_firmware, snapdragon_ar1_gen_1_firmware, snapdragon_ar1_gen_1_platform_\"luna1\"_firmware, snapdragon_x55_5g_modem-rf_system_firmware, sxr2230p_firmware, sxr2250p_firmware, sxr2330p_firmware, wcd9370_firmware, wcd9395_firmware, wcn3950_firmware, wcn3988_firmware, wcn6450_firmware, wcn6650_firmware, wcn6755_firmware, wcn7861_firmware, wcn7881_firmware, wsa8810_firmware, wsa8815_firmware, wsa8830_firmware, wsa8832_firmware, wsa8835_firmware, wsa8840_firmware, wsa8845_firmware, wsa8845h_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
8.6
Impact score
6
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity
HIGH

Known exploits

Data from CISA

Vulnerability name
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Exploit added on
Jun 3, 2025
Exploit action due
Jun 24, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

product-security@qualcomm.com
CWE-863

Social media

Hype score
Not currently trending
  1. Android Physical Memory: CVE-2025-21479 Power-up Record - https://t.co/P6psVxH8Vt #MobileSecurity #infosec #dfir #Android https://t.co/X8ofnIqrTc

    @Din3zh

    22 Aug 2025

    1436 Impressions

    6 Retweets

    54 Likes

    25 Bookmarks

    0 Replies

    0 Quotes

  2. here is a detailed analysis for CVE-2025-21479🥳 https://t.co/b6qvjDjbga

    @hzshang15

    22 Aug 2025

    490 Impressions

    0 Retweets

    12 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

  3. New blog post: A journey in Android physical memory - writeup on exploiting recent GPU bug CVE-2025-21479 https://t.co/9aSzddEzK3

    @dawnseclab

    22 Aug 2025

    10498 Impressions

    61 Retweets

    197 Likes

    123 Bookmarks

    0 Replies

    1 Quote

  4. Root exploit for the Quest 3/3S for the August 7, 2025 update and earlier, based on CVE-2025-21479. https://t.co/rHZMwVL66b

    @ZiL0G80

    17 Aug 2025

    3047 Impressions

    4 Retweets

    27 Likes

    4 Bookmarks

    2 Replies

    0 Quotes

  5. CVE-2025-21479 Meta Quest 3 privilege escalation Exploit poc - https://t.co/oQIMTHQLsj #root #MobileSecurity #infosec #dfir https://t.co/vJMOVHTUnR

    @Din3zh

    15 Aug 2025

    1453 Impressions

    8 Retweets

    27 Likes

    16 Bookmarks

    0 Replies

    0 Quotes

  6. If you have a Meta Quest 3/3S and want to root it, take it off Wi-Fi RIGHT NOW and disable updates: adb shell pm disable-user --user 0 com.oculus.updater The latest update patches CVE-2025-21479.

    @zhuowei

    15 Aug 2025

    31700 Impressions

    45 Retweets

    523 Likes

    159 Bookmarks

    14 Replies

    2 Quotes

  7. 🚨 تحذير أمني: جوجل تصدر تحديث الأمان للأندرويد أغسطس 2025، الذي يعالج ثغرات خطيرة مثل CVE-2025-21479 و CVE-2025-27038. هذه الثغرات استُغلت فعليًا في هجمات موجهة. تأكد من

    @Cybereayn

    10 Aug 2025

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. ⚠️ Fratelli di #Pixel .... aggiornare. Tra le altre, risolte due vulnerabilità critiche ( CVE-2025-21479 e CVE-2025-27038) sfruttate attivamente. https://t.co/AC9tiGyrb7

    @sonoclaudio

    7 Aug 2025

    976 Impressions

    5 Retweets

    19 Likes

    0 Bookmarks

    4 Replies

    0 Quotes

  9. 🚨 Android Bugs این باگ به هکرها اجازه می دهد تلفن شمارا از طریق تراشه گرافیکی ربوده شودبدون کلیک مورد نیاز CVE-2025-21479 مربوط به یک آسیب‌پذیری احرازهویت نادرست د

    @BabakEg27664

    6 Aug 2025

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Active exploitation of CVE-2025-21479, CVE-2025-27038, and CVE-21480 highlights the urgency for Android users to update devices. Qualcomm graphics flaws enable memory corruption and remote code execution. #AndroidUpdate #Qualcomm #Japan https://t.co/U55bBOj8NS

    @TweetThreatNews

    6 Aug 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. CVE-2025-21479 and 27038 Actively Exploited, Google Issues Emergency Android Patches https://t.co/vijL8OY25q

    @matarturo

    6 Aug 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🔨Googleが8月の月例パッチをリリース、悪用が確認されたQualcommの脆弱性2件などを修正(CVE-2025-21479、CVE-2025-27038他) 💻Broadcomチップ搭載のDell製PC100機種以上に複数の重大な欠陥、早急なパッチ適用を呼びか

    @MachinaRecord

    6 Aug 2025

    158 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  13. Google's August 2025 Android security update addresses six vulnerabilities, including two Qualcomm flaws (CVE-2025-21479 and CVE-2025-27038) exploited in targeted attacks. https://t.co/rHOht4GjMG

    @securityRSS

    5 Aug 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Google, Android işletim sistemi için kritik güvenlik güncellemelerini yayınladı. Bu güncellemeler, özellikle sahada aktif olarak kötüye kullanılan iki önemli Qualcomm güvenlik açığını gideriyor. CVE-2025-21479 (CVSS puanı: 8.6) ve CVE-2025-27038 (CVSS puanı: 7

    @et2mas

    5 Aug 2025

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. Google releases Android patches for six vulnerabilities in August 2025 update, including fixes for Qualcomm GPU flaws CVE-2025-21479 and CVE-2025-27038 exploited in targeted attacks. #Android #Qualcomm #Security https://t.co/nWM4PkOwVy

    @TweetThreatNews

    5 Aug 2025

    23 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. CVE-2025-21479 (CVSS:8.6, HIGH) is Analyzed. Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands...https://t.co/TLgtfQIM0C #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    8 Jun 2025

    51 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. Latest Known Exploited Vulnerabilities (#KEV) : #CVE-2025-21479 #Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability https://t.co/3ZYCe79nN9

    @ScyScan

    5 Jun 2025

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Google’ın Android güvenlik ekibi, bazı Snapdragon çiplerinde üç kritik güvenlik açığı buldu. Qualcomm, bu açıkların hedefli siber saldırılarda kullanıldığını doğruladı ve mayıs ayında üreticilere yama gönderdi. Açıklar CVE-2025-21479, 21480 ve 2703

    @webtekno

    5 Jun 2025

    9853 Impressions

    1 Retweet

    11 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  19. Actively exploited CVE : CVE-2025-21479

    @transilienceai

    5 Jun 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  20. Actively exploited CVE : CVE-2025-21479

    @transilienceai

    5 Jun 2025

    35 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  21. 🛡️ We added Qualcomm vulnerabilities CVE-2025-21479, CVE-2025-21480 & CVE-2025-27038—impacting multiple chipsets—to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/aEBiHHlS7W & apply mitigations to protect your org from cyberattacks. https://t.co/

    @NETFIXERTECH

    4 Jun 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性カタログに3件の追加。クアルコムAderno GPUで修正されたCVE-2025-21479、CVE-2025-21480、CVE-2025-27038。対処期限は通常の6/24でランサムウ

    @__kokumoto

    3 Jun 2025

    714 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  23. 🛡️ We added Qualcomm vulnerabilities CVE-2025-21479, CVE-2025-21480 & CVE-2025-27038—impacting multiple chipsets—to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. https://t.co/

    @CISACyber

    3 Jun 2025

    5333 Impressions

    12 Retweets

    32 Likes

    2 Bookmarks

    1 Reply

    1 Quote

  24. Qualcomm fixed three zero-days exploited in limited and targeted attacks CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038 —exploited in limited, targeted attacks, as reported by Google’s Android Security and Threat Analysis teams. The first two (CVSS 8.6) involve incorrect

    @dCypherIO

    3 Jun 2025

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. CVE-2025-21479 Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. https://t.co/a0CobVX3ue

    @CVEnew

    3 Jun 2025

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. [CVE-2025-21479: HIGH] Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.#cve,CVE-2025-21479,#cybersecurity https://t.co/FTYKsUYmwf https://t.co/X4bz5geftH

    @CveFindCom

    3 Jun 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. تحذير أمني عاجل من Qualcomm 3 ثغرات خطيرة من نوع Zero-Day تم استغلالها بهجمات تستهدف مستخدمي أجهزة بمعالجات Adreno GPU، أبرزها CVE-2025-21479. كوالكوم أرسلت تحديثات للمصنّعي

    @mjbtechtips

    2 Jun 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. ⚠️Qualcomm Adreno GPU 0-Day Vulnerabilities Exploited to Attack Android Users Read more: https://t.co/ZwrKSRIKUS 📌CVE-2025-21479 📌CVE-2025-21480 📌CVE-2025-27038 Mobile chipmaker Qualcomm has issued urgent security patches for three critical zero-day vulnerabilitie

    @The_Cyber_News

    2 Jun 2025

    416 Impressions

    2 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Qualcommは、限定的かつ標的型の攻撃で悪用された3件のゼロデイ脆弱性に対するセキュリティパッチを提供した。 これらはGoogle Android Securityチームにより報告されたもので、CVE-2025-21479および21480(CVSS

    @yousukezan

    2 Jun 2025

    2333 Impressions

    0 Retweets

    10 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  30. ⚠️Actualizaciones de seguridad de Qualcomm ❗CVE-2025-21479 ❗CVE-2025-21480 ❗CVE-2025-27038 ➡️Más info: https://t.co/vSdtuBR8xQ https://t.co/BaZy1EnwaJ

    @CERTpy

    2 Jun 2025

    125 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  31. 🚨 Qualcomm just patched 3 zero-days actively exploited in the wild—two rated CVSS 8.6. ▶ CVE-2025-21479 ▶ CVE-2025-21480 ▶ CVE-2025-27038 👀 A twist? Similar bugs were used by spyware vendors like Variston and Cy4Gate. More here: https://t.co/FtxbN7hPcs

    @TheHackersNews

    2 Jun 2025

    13501 Impressions

    69 Retweets

    142 Likes

    23 Bookmarks

    1 Reply

    1 Quote

  32. Qualcomm June 2025 Security Bulletin https://t.co/pD7SaUzvR9 "There are indications from Google TAG that CVE-2025-21479, CVE-2025-21480, CVE-2025-27038 may be under limited, targeted exploitation" https://t.co/7PXRdJk1IS

    @xvonfers

    2 Jun 2025

    15390 Impressions

    9 Retweets

    38 Likes

    20 Bookmarks

    12 Replies

    2 Quotes

Configurations