CVE-2025-21479

What is the Qualcomm Adreno GPU Micronode?

See CVE-2025-21480 for the full product context on the Qualcomm Adreno GPU micronode authorization architecture.

Overview

CVE-2025-21479 is the second incorrect authorization vulnerability (CWE-863) in multiple Qualcomm chipsets from the June 2025 Security Bulletin, patched alongside companion CVE-2025-21480 and CVE-2025-27038. Like CVE-2025-21480, it involves unauthorized command execution in Adreno GPU micronodes through a specific sequence of GPU commands — but targets a different authorization check in the GPU pipeline. Together, the two incorrect authorization vulnerabilities (21479 and 21480) provide alternate exploitation paths to achieve GPU memory corruption on affected Snapdragon-based devices.

Affected Versions

Technical Details

The incorrect authorization (CWE-863) occurs in a second location within the Adreno GPU micronode command dispatch path. A different specific sequence of GPU commands bypasses this authorization check, allowing untrusted code to execute commands in a privileged GPU micronode context, leading to memory corruption.

The existence of two distinct authorization bypass paths (CVE-2025-21479 and CVE-2025-21480) for the same underlying attack surface indicates a systemic authorization design issue in the GPU command processing pipeline, not an isolated coding error. Patching only one CVE while leaving the other unpatched provides incomplete protection.

Key differences from CVE-2025-21480:

• Targets a different GPU command sequence and different authorization check
• Provides an alternative exploitation path for attackers who encounter mitigations targeting CVE-2025-21480 specifically

Exploitation Context

Qualcomm confirmed "indications of limited, targeted exploitation" for CVE-2025-21479 in the June 2025 bulletin. Both CVE-2025-21479 and CVE-2025-21480 were added to the CISA KEV catalog simultaneously, indicating both were observed exploited.

Remediation

1. Apply June 2025 Android security patches (patch level 2025-06-01 or later) from your OEM. This patches CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038 together.
2. Both CVE-2025-21479 and CVE-2025-21480 must be patched to close all authorization bypass paths in the GPU pipeline.
3. Update Chrome promptly for any Chrome-level mitigations that reduce GPU exploit reachability.
4. See CVE-2025-21480 for additional remediation context.