CVE-2025-21480: Qualcomm Multiple Chipsets incorrect authorization in GPU micronode

CVE-2025-21480 · Severity: critical · CVSS 8.6 · Exploited in the wild · Published 2025-06-03

A security vulnerability exists in several Qualcomm chipsets used in mobile devices and connectivity hardware. An attacker could exploit this flaw to corrupt system memory, potentially leading to unauthorized access or device instability. This vulnerability has been observed being used in real-world attacks, making immediate patching critical for maintaining device integrity and user data privacy.

Technologies: Qualcomm Multiple Chipsets. Vendors: Qualcomm.

Quick answers

Is CVE-2025-21480 exploited in the wild?
Yes. CVE-2025-21480 is known to be exploited in the wild, first recorded on 3 June 2025. Treat it as urgent.
How severe is CVE-2025-21480?
Critical severity, with a CVSS score of 8.6, published 3 June 2025.
Which products and versions are affected?
Qualcomm AQT1000 Firmware; Qualcomm FastConnect 6200 Firmware; Qualcomm FastConnect 6700 Firmware; Qualcomm FastConnect 6800 Firmware; and 17 more.
Is there a fix for CVE-2025-21480?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-21480 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2025-21480?
Check whether you run Qualcomm Multiple Chipsets. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an Incorrect Authorization (CWE-863) issue within the GPU micronode of various Qualcomm chipsets. It occurs when a specific sequence of commands is executed, leading to unauthorized command execution and subsequent memory corruption. The attack vector is local, requiring user interaction (UI:R) to trigger the exploit, but it results in a scope change (S:C) with high impact on confidentiality, integrity, and availability. CISA has confirmed active exploitation of this vulnerability. Users should apply firmware updates provided by their device manufacturers.

Affected products

  • Qualcomm AQT1000 Firmware
  • Qualcomm FastConnect 6200 Firmware
  • Qualcomm FastConnect 6700 Firmware
  • Qualcomm FastConnect 6800 Firmware
  • Qualcomm FastConnect 6900 Firmware
  • Qualcomm FastConnect 7800 Firmware
  • Qualcomm QCA6391 Firmware
  • Qualcomm QCM4490 Firmware
  • Qualcomm QCS4490 Firmware
  • Qualcomm SC8380XP Firmware
  • Qualcomm SD855 Firmware
  • Qualcomm SM4635 Firmware
  • Qualcomm SM6250 Firmware
  • Qualcomm SM6650 Firmware
  • Qualcomm SM7325P Firmware
  • Qualcomm SM7635 Firmware
  • Qualcomm SM7675 Firmware
  • Qualcomm SM8550P Firmware
  • Qualcomm SM8635 Firmware
  • Qualcomm SM8650Q Firmware
  • Qualcomm Snapdragon 460 Mobile Platform Firmware

Timeline

  • 2025-06-03: disclosed
  • 2025-06-03: advisory
  • 2025-06-03: kev added: Added to CISA KEV catalog on publication date
  • 2025-06-03: exploited: Reported as exploited in the wild at the time of disclosure

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.