EUVD-2025-16710
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Analysis
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.
Technical Context
This is a separate vulnerability in the same Qualcomm GPU micronode component as CVE-2025-21480, suggesting a systemic weakness in command validation within the GPU firmware. Both vulnerabilities stem from insufficient authorization checks on GPU commands, indicating that multiple command paths lack proper validation. The dual CVEs suggest the attack surface in GPU firmware is broader than initially assessed.
Affected Products
['Qualcomm chipsets with Adreno GPU (per Qualcomm security bulletin)']
Remediation
Apply Android security patch. Both CVE-2025-21479 and CVE-2025-21480 must be patched. Enforce minimum security patch levels via MDM.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today