Risk Letters

Exploited vulnerability

CVE-2025-21480

TLP:CLEAR

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Facts

  • Vendor: Qualcomm
  • Product: Multiple Chipsets
  • CVSS: 8.6
  • EPSS (probability of exploitation within 30 days): 0.4 %
  • On CISA's Known Exploited Vulnerabilities list since: 3 June 2025
  • First known exploitation: 3 June 2025
  • CISA's deadline for US federal agencies: 24 June 2025
  • Weakness: CWE-863
  • First seen by Risk Letters: 3 June 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD