{"id":"CVE-2025-21480","kind":"vulnerability","aliases":["CVE-2025-21480"],"related":[],"title":"Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands","description":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have an incorrect authorization flaw in the GPU micronode that lets unauthorized commands run during a specific command sequence. An attacker can corrupt memory on the affected device, and CISA reports it is being exploited in the wild.","severity":"high","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2025-06-03T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm aqt1000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6200 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6900 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs4490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sc8380xp firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd855 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm4635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7325p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7675 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7675p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8550p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8650q firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 4 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 460 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480\\+ 5g mobile platform \\(sm4350-ac\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 662 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 680 4g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 685 4g mobile platform \\(sm6225-ad\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 690 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 695 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 720g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g\\+ 5g mobile platform \\(sm7325-ae\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 782g mobile platform \\(sm7325-af\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7c\\+ gen 3 compute firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 3 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8\\+ gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations and patches from the vendor (Qualcomm security bulletin); the sources do not name a specific version or setting.","status":"open","published_at":"2025-06-03T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:47:01+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:47:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patches from the vendor (Qualcomm security bulletin); the sources do not name a specific version or setting.","reach":"local","summary":"Multiple Qualcomm chipsets have an incorrect authorization flaw in the GPU micronode that lets unauthorized commands run during a specific command sequence. An attacker can corrupt memory on the affected device, and CISA reports it is being exploited in the wild.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker corrupts device memory via unauthorized GPU command execution, possibly gaining code execution.","analyst_note":"Find the Qualcomm security bulletin for CVE-2025-21480 to get affected chipsets, patched versions and how devices are checked; sources here only cite the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00045,"input_tokens":2572,"output_tokens":385,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':319C '-2025':18A,21A '-21480':19A,22A '1':104A '2':211A,227A '22':318C '3':204A,219A '4':102A '460':110A '480':116A,123A '4g':140A,147A '5g':117A,124A,157A,164A,177A,184A '6200':31A '662':133A '6700':35A '680':139A '6800':39A '685':146A '690':156A '6900':43A '695':163A '720g':170A '778g':176A,183A '7800':47A '782g':193A '7c':202A '8':209A,217A,225A 'ac':129A 'action':309C 'ad':152A 'ae':189A 'af':198A 'affect':267B 'allow':289C 'android':231B 'appli':310C 'applic':316C 'aqt1000':27A 'attack':261B 'author':244B,285C 'bod':317C 'chipset':240B,281C 'chipsets':25A 'cisa':270B,307C 'cloud':322C 'command':6A,16A,253B,258B,296C,306C 'compute':205A 'contain':282C 'corrupt':2A,263B,292C 'cve':17A,20A 'devic':236B,268B 'discontinu':325C 'due':3A,293C 'execut':7A,12A,297C,302C 'exploit':232B,275B 'fastconnect':30A,34A,38A,42A,46A 'firmware':28A,32A,36A,40A,44A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,107A,113A,120A,130A,136A,143A,153A,160A,167A,173A,180A,190A,199A,206A,214A,222A,230A 'flaw':245B 'follow':315C 'gen':103A,203A,210A,218A,226A 'gpu':9A,248B,299C 'guidanc':320C 'incorrect':243B,284C 'infrastructur':233B 'instruct':314C 'let':251B 'memori':1A,264B,291C 'micronod':10A,249B,300C 'mitig':311C,331C 'mobil':235B 'mobile':105A,111A,118A,125A,134A,141A,148A,158A,165A,171A,178A,185A,194A,212A,220A,228A 'mobile-devic':234B 'multipl':238B,279C 'multiple':24A 'per':312C 'platform':106A,112A,119A,126A,135A,142A,149A,159A,166A,172A,179A,186A,195A,213A,221A,229A 'product':329C 'qca6391':50A 'qcm4490':53A 'qcs4490':56A 'qualcomm':23A,26A,29A,33A,37A,41A,45A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,108A,114A,121A,131A,137A,144A,154A,161A,168A,174A,181A,191A,200A,207A,215A,223A,237B,239B,280C 'report':271B 'requir':308C 'run':254B 'sc8380xp':59A 'sd855':62A 'sequenc':14A,259B,304C 'servic':323C 'sm4350':128A 'sm4350-ac':127A 'sm4635':65A 'sm6225':151A 'sm6225-ad':150A 'sm6250':68A 'sm6650':71A 'sm6650p':74A 'sm7325':188A,197A 'sm7325-ae':187A 'sm7325-af':196A 'sm7325p':77A 'sm7635':80A 'sm7675':83A 'sm7675p':86A 'sm8550p':89A 'sm8635':92A 'sm8635p':95A 'sm8650q':98A 'snapdragon':101A,109A,115A,122A,132A,138A,145A,155A,162A,169A,175A,182A,192A,201A,208A,216A,224A 'specif':13A,257B,303C 'unauthor':5A,252B,295C 'unavail':333C 'use':326C 'vendor':313C 'vulner':286C,288C 'wild':278B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-03T00:00:00+00:00","kev":{"dateAdded":"2025-06-03","dueDate":"2025-06-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-21480","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21480","severity":null,"published_at":"2025-06-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-21480","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21480","severity":null,"published_at":"2025-06-03T06:15:26+00:00","modified_at":"2026-06-17T08:43:33+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}