ACTIVELY EXPLOITED
CVE-2025-21479: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
| Vendor | Qualcomm |
|---|---|
| Product | Multiple Chipsets |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Jun 2025 |
| CISA federal deadline | 24 Jun 2025 |
| Weakness (CWE) | CWE-863 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
SOURCES
Other Qualcomm flaws
- CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability
- CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
- CVE-2025-21480: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
- CVE-2024-43047: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
- CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.