{"id":"CVE-2025-21479","kind":"vulnerability","aliases":["CVE-2025-21479"],"related":[],"title":"Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands","description":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have an incorrect authorization flaw in the GPU micronode that lets unauthorized commands run and corrupts memory. CISA reports it is being exploited in the wild.","severity":"high","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2025-06-03T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm aqt1000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6200 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6900 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs4490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd855 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm4635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7325p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7675 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7675p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8550p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8650q firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 4 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 460 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480\\+ 5g mobile platform \\(sm4350-ac\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 662 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 680 4g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 685 4g mobile platform \\(sm6225-ad\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 690 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 695 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 720g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g\\+ 5g mobile platform \\(sm7325-ae\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 782g mobile platform \\(sm7325-af\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7c\\+ gen 3 compute firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 3 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8\\+ gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 855 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigation per Qualcomm's security bulletin; CISA says to discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2025-06-03T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:59+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:46:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per Qualcomm's security bulletin; CISA says to discontinue use of the product if mitigations are unavailable.","reach":"local","summary":"Multiple Qualcomm chipsets have an incorrect authorization flaw in the GPU micronode that lets unauthorized commands run and corrupts memory. CISA reports it is being exploited in the wild.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker corrupts memory via unauthorized GPU commands, possibly gaining code execution on the device.","analyst_note":"Find the affected chipset list and patch level in Qualcomm's December 2025 security bulletin and check the CISA KEV entry for due date and exact mitigation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000439,"input_tokens":2572,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':310C '-2025':18A,21A '-21479':19A,22A '1':101A '2':208A,224A '22':309C '3':201A,216A '4':99A '460':107A '480':113A,120A '4g':137A,144A '5g':114A,121A,154A,161A,174A,181A '6200':31A '662':130A '6700':35A '680':136A '6800':47A '685':143A '690':153A '6900':39A '695':160A '720g':167A '778g':173A,180A '7800':43A '782g':190A '7c':199A '8':206A,214A,222A '855':230A 'ac':126A 'action':300C 'ad':149A 'ae':186A 'af':195A 'allow':280C 'android':234B 'appli':301C 'applic':307C 'aqt1000':27A 'author':247B,276C 'bod':308C 'chipset':243B,272C 'chipsets':25A 'cisa':261B,298C 'cloud':313C 'command':6A,16A,256B,287C,297C 'compute':202A 'contain':273C 'corrupt':2A,259B,283C 'cve':17A,20A 'devic':239B 'discontinu':316C 'due':3A,284C 'execut':7A,12A,288C,293C 'exploit':235B,266B 'fastconnect':30A,34A,38A,42A,46A 'firmware':28A,32A,36A,40A,44A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,104A,110A,117A,127A,133A,140A,150A,157A,164A,170A,177A,187A,196A,203A,211A,219A,227A,233A 'flaw':248B 'follow':306C 'gen':100A,200A,207A,215A,223A 'gpu':9A,251B,290C 'guidanc':311C 'incorrect':246B,275C 'infrastructur':236B 'instruct':305C 'let':254B 'memori':1A,260B,282C 'micronod':10A,252B,291C 'mitig':302C,322C 'mobil':238B 'mobile':102A,108A,115A,122A,131A,138A,145A,155A,162A,168A,175A,182A,191A,209A,217A,225A,231A 'mobile-devic':237B 'multipl':241B,270C 'multiple':24A 'per':303C 'platform':103A,109A,116A,123A,132A,139A,146A,156A,163A,169A,176A,183A,192A,210A,218A,226A,232A 'product':320C 'qca6391':50A 'qcm4490':53A 'qcs4490':56A 'qualcomm':23A,26A,29A,33A,37A,41A,45A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,105A,111A,118A,128A,134A,141A,151A,158A,165A,171A,178A,188A,197A,204A,212A,220A,228A,240B,242B,271C 'report':262B 'requir':299C 'run':257B 'sd855':59A 'sequenc':14A,295C 'servic':314C 'sm4350':125A 'sm4350-ac':124A 'sm4635':62A 'sm6225':148A 'sm6225-ad':147A 'sm6250':65A 'sm6650':68A 'sm6650p':71A 'sm7325':185A,194A 'sm7325-ae':184A 'sm7325-af':193A 'sm7325p':74A 'sm7635':77A 'sm7675':80A 'sm7675p':83A 'sm8550p':86A 'sm8635':89A 'sm8635p':92A 'sm8650q':95A 'snapdragon':98A,106A,112A,119A,129A,135A,142A,152A,159A,166A,172A,179A,189A,198A,205A,213A,221A,229A 'specif':13A,294C 'unauthor':5A,255B,286C 'unavail':324C 'use':317C 'vendor':304C 'vulner':277C,279C 'wild':269B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-03T00:00:00+00:00","kev":{"dateAdded":"2025-06-03","dueDate":"2025-06-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-21479","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21479","severity":null,"published_at":"2025-06-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-21479","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21479","severity":null,"published_at":"2025-06-03T07:15:20+00:00","modified_at":"2026-06-17T08:43:33+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}