Critical Authorization Flaw in Qualcomm Chipsets (CVE‑2025‑21480) Enables GPU Memory Corruption
What It Is – Qualcomm disclosed CVE‑2025‑21480, an incorrect‑authorization flaw in multiple Snapdragon and other Qualcomm chipsets. The defect permits an attacker to issue a crafted sequence of GPU micronode commands that bypass authorization checks, leading to memory corruption.
Exploitability – The vulnerability is publicly listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating that exploit code or active exploitation is believed to exist. A CVSS v3.1 base score of 8.6 (High) has been assigned.
Affected Products – Qualcomm Snapdragon 8 Gen 1, Snapdragon 7 Gen 2, and several other Qualcomm‑based SoCs used in smartphones, tablets, automotive infotainment, and IoT devices.
Why It Matters for Trust & Control Assurance
- Vendor‑risk visibility – A hardware‑level flaw bypasses built‑in access controls, highlighting the need for continuous oversight of third‑party component security.
- Patch‑management evidence – Demonstrating timely firmware updates and documented remediation is a core control objective for audit readiness across frameworks (e.g., NIST CSF, ISO 27001).
- Defensible audit trail – Capturing remediation actions, version inventories, and validation testing provides the evidence auditors expect for “secure configuration management.”
Recommended Actions
- Inventory all devices that run the listed Qualcomm chipsets.
- Apply Qualcomm’s firmware patches immediately; verify patch version against the vendor advisory.
- Record remediation steps in a centralized change‑management system to create audit‑ready evidence.
- Incorporate the chipset patch status into your continuous third‑party risk monitoring program.
Source: CISA KEV – CVE‑2025‑21480