CVE-2025-21479

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.008 · 58 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 15 exploits · PoC

Likely / severe?

0.84% (58th) EPSS

CVSS 8.6 · high

Is it mine?

233 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-06-03remediate by 2025-06-24

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-22

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

cvss

Technical severity, 0–10. One row per scoring source.

8.6

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.6highAV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.6highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.6highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · product-security@qualcomm.comexploitability 1.8 · impact 6

v3.18.6highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-863USCWE-863US

exploits (15)

Public proof-of-concept and weaponised exploit code.

affected products (233)

Products and version ranges known to be affected.

Google Android 13 <2025-08-01all versionscert_bundDE
Google Android 14 <2025-08-01all versionscert_bundDE
Google Android 15 <2025-08-01all versionscert_bundDE
Google Android 16 <2025-08-01all versionscert_bundDE
Google Android≤ 13 <2025-08-01cert_bundDE
Google Android≤ 15 <2025-08-01cert_bundDE
Google Android≤ 16 <2025-08-01cert_bundDE
Google Android≤ 14 <2025-08-01cert_bundDE
Qualcomm, Inc. Snapdragon≤ Snapdragon 695 5G Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SM6650Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WCD9341enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 4 Gen 1 Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WSA8845enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SM6250enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WSA8845Henisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SD855enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 782G Mobile Platform (SM7325-AF)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 888+ 5G Mobile Platform (SM8350-AC)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 690 5G Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WSA8835enisa_euvdEU

showing 20 of 233

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-1709Android Patchday August 2025: Multiple VulnerabilitiesDeutsch2025-08-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, beliebigen Code auszuführen oder andere nicht näher bezeichnete Angriffe durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2025-06-03modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan