CVE-2025-21480: Qualcomm GPU micronode memory corruption via unauthorized command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with known exploitation and a CVSS of 8.6, but it requires local access and user interaction, which limits mass remote exploitation.

What it is

A memory corruption flaw in Qualcomm's GPU micronode is caused by incorrect authorization (CWE-863), allowing an unauthorized command sequence to be executed. It affects a broad set of Qualcomm chipset firmware, including FastConnect, Snapdragon and QCA parts, so the exposure spans many device families. Successful abuse corrupts memory and can compromise confidentiality, integrity and availability beyond the vulnerable component's security scope.

Impact

An attacker who can deliver the crafted command sequence gains memory corruption in the GPU micronode, with high impact to confidentiality, integrity and availability and a scope change beyond the vulnerable component. This can lead to code execution or denial of service in the affected firmware context.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), so the attacker needs a local foothold or a way to trigger the command sequence on the device, plus some user action. The description does not specify the exact delivery mechanism, so the precise trigger path is not stated in the record.

Exploitation

CVE-2025-21480 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2025-06-03, due 2025-06-24), indicating known exploitation in the wild. EPSS is low (0.0046, 38.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Qualcomm June 2025 security bulletin fixes for the affected chipsets as the first action.
• Follow CISA BOD 22-01 guidance and meet the 2025-06-24 remediation due date, or discontinue use of affected products if no mitigation is available.
• Restrict local access and untrusted code execution paths on devices using the affected Qualcomm firmware.
• Track vendor firmware updates for the listed FastConnect, Snapdragon, QCA and SC/SM parts and redeploy patched images.
• Reduce user-driven triggers by hardening application and driver interfaces that can issue GPU micronode commands.

Detection

• Monitor for crashes, GPU faults or memory corruption indicators in the GPU micronode on affected Qualcomm devices.
• Watch for anomalous or unexpected command sequences reaching GPU micronode interfaces from local processes.
• Correlate device telemetry with the Qualcomm June 2025 bulletin affected chipset list to identify unpatched assets.
• Review local application and driver logs for unauthorized command execution attempts against GPU components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.