CVE-2025-21479
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 June 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- CVSS 3.1
- 8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Listed 3 June 2025 · due 24 June 2025
- Weakness
- CWE-863
- Affected
- qualcomm/aqt1000 firmware · qualcomm/fastconnect 6200 firmware · qualcomm/fastconnect 6700 firmware · qualcomm/fastconnect 6900 firmware · qualcomm/fastconnect 7800 firmware · qualcomm/fastconnect 6800 firmware · qualcomm/qca6391 firmware · qualcomm/qcm4490 firmware · qualcomm/qcs4490 firmware · qualcomm/sd855 firmware · qualcomm/sm4635 firmware · qualcomm/sm6250 firmware · qualcomm/sm6650 firmware · qualcomm/sm6650p firmware · qualcomm/sm7325p firmware · qualcomm/sm7635 firmware · qualcomm/sm7675 firmware · qualcomm/sm7675p firmware · qualcomm/sm8550p firmware · qualcomm/sm8635 firmware · +40 more
- Source
- product-security@qualcomm.com
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-21479
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.