What is the CVSS score of CVE-2025-21479?

CVE-2025-21479 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wcn7881 Firmware are affected by CVE-2025-21479?

CVE-2025-21479 is a high-severity GPU micronode vulnerability being actively exploited in the wild that allows unauthorized command execution through memory corruption.

Is CVE-2025-21479 being actively exploited?

Yes, CVE-2025-21479 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-21479?

Within 24 hours: Identify and inventory all systems running affected GPU micronode versions; isolate critical GPU infrastructure from untrusted networks; enable enhanced logging on GPU operations. Within 7 days: Deploy network segmentation to restrict GPU micronode communication to essential systems only; implement input validation and command filtering at the application layer; establish monitoring for anomalous GPU command sequences. Within 30 days: Engage with GPU vendor for patch timeline; evaluate alternative GPU solutions or temporary hardware replacement; conduct forensic analysis of GPU logs for signs of exploitation.

Wcn7881 Firmware CVE-2025-21479

EUVD-2025-16710 HIGH

Incorrect Authorization (CWE-863)

2025-06-03 product-security@qualcomm.com

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16710

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

Added to CISA KEV

Oct 28, 2025 - 13:48 cisa

CISA KEV

CVE Published

Jun 03, 2025 - 07:15 nvd

HIGH 8.6

DescriptionCVE.org

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

AnalysisAI

A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.

Technical ContextAI

This is a separate vulnerability in the same Qualcomm GPU micronode component as CVE-2025-21480, suggesting a systemic weakness in command validation within the GPU firmware. Both vulnerabilities stem from insufficient authorization checks on GPU commands, indicating that multiple command paths lack proper validation. The dual CVEs suggest the attack surface in GPU firmware is broader than initially assessed.