CVE-2025-21480

CVE-2025-21480 is a memory corruption flaw caused by unauthorized command execution in the GPU micronode of Qualcomm chipsets, triggered when a specific sequence of commands is executed. A local attacker (the CVSS vector requires local access and user interaction, such as running a malicious app) could corrupt GPU memory, leading to high-impact impacts on confidentiality, integrity, and availability, though specific privilege-escalation details are not disclosed in the available data. Affected silicon spans a dozen Qualcomm chipsets and connectivity components, including Snapdragon 855 (SD855), Snapdragon 8 Gen 3 (SC8380XP), FastConnect 6200/6700/6800/6900/7800, QAM/AQT1000, QCA6391, QCM4490, QCS4490, and SM4635, meaning a wide range of Android smartphones and IoT/device platforms are potentially impacted. Qualcomm has assigned the CVE, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-06-03; trade press reports indicate Qualcomm fixed three zero-days, including GPU-related bugs, exploited in limited, targeted attacks via the Adreno GPU. No public proof-of-concept is known, but active exploitation is confirmed, and defenders should treat this as exploited in the wild.

What to do: Apply the June 2025 (and later) Android security bulletin/OEM patches, which carry Qualcomm's fixes, by updating affected phones and devices as vendor updates become available, and check with your device OEM whether your chipset (e.g., Snapdragon 855, 8 Gen 3, or listed FastConnect parts) is covered. Because the local attack vector likely requires a malicious app, avoid installing untrusted apps on unpatched devices as an interim mitigation. U.S. federal agencies must follow CISA BOD 22-01 required actions per the KEV entry, applying vendor mitigations or discontinuing use of affected products if mitigations are unavailable.