CVE-2025-21480: high-severity vulnerability in Qualcomm, Inc. Snapdragon
Incorrect Authorization in Graphics Windows
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in graphics system authorization allows attackers to execute unauthorized commands on the GPU, corrupting memory through a specific sequence of operations. This can lead to system crashes or potential code execution with elevated privileges.
CWE-863 authorization bypass in GPU micronode command validation permits unauthenticated or unprivileged process to execute restricted GPU commands without proper access checks. Exploitation requires crafting a precise command sequence that bypasses authorization gates, resulting in memory corruption that may enable privilege escalation or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.