Secuno
ENNL
Book demo

CVE-2025-21479

Qualcomm Multiple Chipsets Incorrect Authorization

8.6 HIGHActively exploited (CISA KEV)EPSS 0.84%
  1. Published3 Jun 2025
  2. Added to CISA KEV3 Jun 2025
  3. Remediation due24 Jun 2025
Actively exploited (CISA KEV)

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Added to KEV: 3 Jun 2025Federal remediation due: 24 Jun 2025

Description

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Qualcomm Aqt1000 Firmwareall versions
Qualcomm Fastconnect 6200 Firmwareall versions
Qualcomm Fastconnect 6700 Firmwareall versions
Qualcomm Fastconnect 6800 Firmwareall versions
Qualcomm Fastconnect 6900 Firmwareall versions
Qualcomm Fastconnect 7800 Firmwareall versions
Qualcomm Qca6391 Firmwareall versions
Qualcomm Qcm4490 Firmwareall versions
Qualcomm Qcs4490 Firmwareall versions
Qualcomm Sd855 Firmwareall versions
Qualcomm Sm4635 Firmwareall versions
Qualcomm Sm6250 Firmwareall versions
Qualcomm Sm6650 Firmwareall versions
Qualcomm Sm6650p Firmwareall versions
Qualcomm Sm7325p Firmwareall versions
Qualcomm Sm7635 Firmwareall versions
Qualcomm Sm7675 Firmwareall versions
Qualcomm Sm7675p Firmwareall versions
Qualcomm Sm8550p Firmwareall versions
Qualcomm Sm8635 Firmwareall versions
Qualcomm Sm8635p Firmwareall versions
Qualcomm Sm8650q Firmwareall versions
Qualcomm Snapdragon 460 Mobile Platform Firmwareall versions
Qualcomm Snapdragon 480 5g Mobile Platform Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-163018.5
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before…
CVE-2026-1095598.7
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that…
CVE-2026-773669.9
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian…
CVE-2026-1039038.8
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik…
CVE-2026-1087468.8
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in…
CVE-2026-816499.1
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper…

Frequently asked

Is CVE-2025-21479 being actively exploited?

Yes. CVE-2025-21479 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Jun 2025.

How severe is CVE-2025-21479?

CVE-2025-21479 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 0.84% probability of exploitation.

Which products are affected by CVE-2025-21479?

Affected products include Qualcomm Aqt1000 Firmware, Qualcomm Fastconnect 6200 Firmware, Qualcomm Fastconnect 6700 Firmware, Qualcomm Fastconnect 6800 Firmware, Qualcomm Fastconnect 6900 Firmware, and 19 more.

How do I fix CVE-2025-21479?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-21479 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.