CVE-2025-21479highunder attackCWE-863

CVE-2025-21479: high-severity vulnerability in Qualcomm, Inc. Snapdragon

Incorrect Authorization in Graphics

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.6epss 0.8%
from disclosure to weapon16 days
Published on NVDJun 3
1st PoC+16d
CISA KEVJun 3
exploitation probability
0.8%top 43% of all CVEs
observed exploitation
yesCISA + VulnCheck
13 public exploit(s)
Action required by CISAfederal deadline: 2025-06-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in GPU graphics processing allows attackers to run unauthorized commands that corrupt system memory. This can lead to crashes, data theft, or system compromise.

Technical detail

CWE-863 authorization bypass in GPU micronode command execution permits memory corruption through a specific command sequence. Attack vector requires local access to GPU interface with insufficient privilege validation; impacts confidentiality, integrity, and availability of system memory.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Qualcomm, Inc. · Snapdragon
public PoCs found — 13
vulncheckvulncheck.com/xdb/eb7564623d6bunverifiedvulncheckvulncheck.com/xdb/cf29a947e893unverifiedvulncheckvulncheck.com/xdb/deed3e48d1e4unverifiedvulncheckvulncheck.com/xdb/103395b2e7f5unverifiedvulncheckvulncheck.com/xdb/c9ba309ae25bunverifiedvulncheckvulncheck.com/xdb/13d1e869f88cunverifiedvulncheckvulncheck.com/xdb/018c3603db1funverifiedvulncheckvulncheck.com/xdb/5b9d22c7580dunverifiedvulncheckvulncheck.com/xdb/1d17fe6bf7ebunverifiedvulncheckvulncheck.com/xdb/136d92d5a92bunverifiedvulncheckvulncheck.com/xdb/4c85b9e4b4e3unverifiedvulncheckvulncheck.com/xdb/15ddeab4ac02unverifiedvulncheckvulncheck.com/xdb/28d0b06bf6e0unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Qualcomm, Inc. Snapdragon

In the same product, most dangerous first.

CVE-2026-21385HIGHInteger Overflow or Wraparound in GraphicsEPSS 1.3%KEVCVE-2025-27038HIGHUse After Free in GraphicsEPSS 1.0%KEVCVE-2023-33106HIGHUse of Out-of-range Pointer Offset in GraphicsEPSS 0.8%KEVCVE-2023-33107HIGHInteger Overflow or Wraparound in Graphics LinuxEPSS 0.7%KEVCVE-2023-33063HIGHUse After Free in DSP ServicesEPSS 0.7%KEVCVE-2024-43047HIGHUse After Free in DSP ServiceEPSS 0.7%KEV
References
https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21479