EUVD-2025-16705Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.6 (High). KEV-listed — actively exploited. EPSS 1.5%. Qualcomm GPU found in majority of Android devices. Kernel-level access from app context. Used in sophisticated mobile exploit chains. |
| Exploit ScenarioDerived | A malicious app on an Android device submits a crafted sequence of GPU commands through the Adreno GPU driver. The micronode processes these commands, triggering unauthorized execution that corrupts kernel memory. The attacker escalates from app sandbox to kernel level, enabling full device compromise, surveillance, and data extraction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Earlier versions of this analysis (1)
Qualcomm GPU micronode contains a memory corruption vulnerability (CWE-863) triggered by unauthorized command execution during specific GPU command sequences, enabling privilege escalation through the GPU driver.
RemediationAI
Apply Android security patch. Ensure devices receive regular security updates. Enterprise: enforce minimum security patch level via MDM.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Qualcomm Adreno GPU firmware's micronode component, where specific sequences of GPU commands trigger unauthorized execution that corrupts memory. GPU drivers operate at kernel privilege level, so GPU-based exploitation provides a path from userspace (app) to kernel level. This is an increasingly common attack surface as GPUs become more complex and their drivers more privileged.
Know when Aqt1000 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Executive ViewAI
CVE-2025-21480 is an actively exploited memory corruption vulnerability affecting GPU micronode systems with a high severity rating (CVSS 8.6). Without an available patch, organizations running vulnerable GPU infrastructure face immediate risk of unauthorized command execution and potential system compromise, requiring urgent mitigation measures to prevent exploitation.
Implement network segmentation isolating GPU micronodes to trusted networks only; disable non-essential GPU micronode features and command execution capabilities; deploy intrusion detection/prevention systems (IDS/IPS) with signatures detecting malicious GPU command sequences; enforce strict access controls and multi-factor authentication for GPU micronode administration; implement comprehensive logging and SIEM monitoring of all GPU command execution; use rate-limiting and anomaly detection on GPU command pipelines; consider GPU workload isolation using containerization or virtualization; maintain offline backups of critical systems dependent on GPU infrastructure.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Aqt1000 Firmware
View allA second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
Memory corruption while handling payloads from remote ESL. Rated critical severity (CVSS 9.8), this vulnerability is rem
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received
Memory corruption in video due to configuration weakness. Rated critical severity (CVSS 9.8), this vulnerability is remo
Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. Rated critical severity (
Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute
memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdr
Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, S
Memory corruption in video module due to buffer overflow while processing WAV file in Snapdragon Auto, Snapdragon Comput
Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snap
GitHub PoC
Exploit-DB