EUVD-2025-16705
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Analysis
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Technical Context
The vulnerability exists in the Qualcomm Adreno GPU firmware's micronode component, where specific sequences of GPU commands trigger unauthorized execution that corrupts memory. GPU drivers operate at kernel privilege level, so GPU-based exploitation provides a path from userspace (app) to kernel level. This is an increasingly common attack surface as GPUs become more complex and their drivers more privileged.
Affected Products
['Qualcomm chipsets with Adreno GPU (per Qualcomm security bulletin)']
Remediation
Apply Android security patch. Ensure devices receive regular security updates. Enterprise: enforce minimum security patch level via MDM.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today