Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (CVE-2025-21479)
Severity: high · Patch status: unknown · Since 2025-06-03 · CVE-2025-21479
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. CISA added CVE-2025-21479 to its Known Exploited Vulnerabilities catalog on Jun 3, 2025, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Jun 24, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch