erroneo.us
Search all guides⌘K

Security Digest · Jun 2, 2025 · Vulnerability · Mobile

Qualcomm Adreno CVE-2025-21479: Three Exploited GPU Bugs

Three Adreno GPU driver bugs under targeted attack, patched by Qualcomm in mid-2025. Android patch level 2025-08-05 covers two. Check old Snapdragon devices.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Patched in Android since August 2025, so current Snapdragon phones are fine; check devices stuck on older patch levels, and confirm CVE-2025-21480 with your OEM.

Who must act: Owners of Snapdragon-based Android phones, tablets, wearables and XR devices on security patch levels before 2025-08-05, or on models that no longer receive updates.

Who can relax: Supported Snapdragon devices on patch level 2025-08-05 or later whose OEM has also shipped Qualcomm's June 2025 fixes, and devices without Qualcomm chipsets.

Affected
Dozens of Snapdragon chipsets listed by Qualcomm, including Snapdragon 8 Gen 2, 8 Gen 3, 888, 865, 778G and 695 (CVE-2025-21479, CVE-2025-21480)
Snapdragon 4 Gen 2, 6 Gen 1, 680/685 and W5+ Gen 1, among others (CVE-2025-27038)
Android devices with affected chipsets on security patch levels before 2025-08-05
Fixed in
Qualcomm patches provided to OEMs in May 2025 (June 2025 bulletin)
Android security patch level 2025-08-05 or later (CVE-2025-21479, CVE-2025-27038)
CVE-2025-21480: OEM-specific updates; not listed in Android bulletins
CVSS
8.6 (v3.1, vendor)
EPSS
1.0% (percentile 63)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Pull security patch level and chipset for every managed Android device and flag Qualcomm devices below 2025-08-05.
  2. Set a compliance rule that blocks corporate access for devices below that patch level.
  3. Check your OEMs' security bulletins to confirm they shipped Qualcomm's June 2025 fixes, including CVE-2025-21480.
  4. Retire Snapdragon devices that no longer receive security updates.
  5. Prioritize high-risk users (executives, administrators, journalists) for updates and, if they ran unpatched devices in 2025, a forensic review.

How to check if you are affected or compromised

  • Check patch level with adb shell getprop ro.build.version.security_patch and chipset with adb shell getprop ro.soc.model (Android 12 and later).
  • Qualcomm and Google published no indicators of compromise or attacker details as of Oct 23, 2026; a current patch level is the main signal.
  • For high-risk users whose devices lagged in 2025, use a mobile forensics specialist rather than on-device checks.

What happened#

On June 2, 2025, Qualcomm's June 2025 security bulletin flagged three Adreno GPU driver flaws. Citing Google's Threat Analysis Group, it said CVE-2025-21479, CVE-2025-21480 and CVE-2025-27038 "may be under limited, targeted exploitation." Qualcomm had made patches available to device makers in May, BleepingComputer reported. CISA added all three to the KEV catalog on June 3, with a June 24 deadline.

  • CVE-2025-21479 and CVE-2025-21480 are incorrect-authorization bugs (CWE-863). They allow "memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands." Qualcomm scores both CVSS 3.1 8.6. They were reported through the Google Android Security team in late January.
  • CVE-2025-27038 is a use-after-free causing memory corruption "while rendering graphics using Adreno GPU drivers in Chrome." Qualcomm scores it 7.5 with a network attack vector, which, together with the Chrome reference, suggests it is reachable from web content. It was reported in March.

No technical write-up, attacker name or target profile has been published as of Oct 23, 2026.

Who is affected#

The CVE records list dozens of chipsets. For CVE-2025-21479 and CVE-2025-21480 these include Snapdragon 8 Gen 2, 8 Gen 3, 888, 865, 778G, 695 and 4 Gen 1, plus XR and compute parts. CVE-2025-27038 covers others, including Snapdragon 4 Gen 2, 6 Gen 1, 680/685 and the W5+ Gen 1 wearable platform. Fixes reach users only through device makers.

Google's August 2025 Android Security Bulletin added CVE-2025-21479 (Critical, per Qualcomm) and CVE-2025-27038 (High) at patch level 2025-08-05. CVE-2025-21480 does not appear in Android bulletins from June through September 2025, so confirm it with your OEM.

Do you really need to act?#

For supported phones that have updated since August 2025, no. As The Hacker News noted, the fixes arrived in Android two months after Qualcomm's bulletin. Devices stayed exposed during that lag between chipmaker patch and device update.

Still exposed: Snapdragon devices below 2025-08-05, models past their OEM's support window, slow-patching budget brands, and rugged, kiosk, wearable or XR devices that update rarely. Qualcomm's scores, shown on NVD, rate 21479 and 21480 as local bugs needing user interaction. That is consistent with a privilege-escalation step in a chain that starts in a browser or app, though Qualcomm has not said how they were used. Exploitation was limited and targeted, not mass.

What to do now#

  1. Pull patch level and chipset per device from your MDM, or run adb shell getprop ro.build.version.security_patch and adb shell getprop ro.soc.model (Android 12 and later).
  2. Block corporate access for Qualcomm devices below 2025-08-05, and push updates to non-compliant devices.
  3. Check your OEMs' bulletins to confirm they shipped Qualcomm's June 2025 fixes, including CVE-2025-21480.
  4. Retire Snapdragon devices that no longer receive security updates.
  5. Prioritize high-risk users such as executives, administrators and journalists.

How to tell if you were hit#

Qualcomm and Google have released no indicators of compromise. A current patch level is the main check, and anything below 2025-08-05 during 2025 was exposed. GPU driver exploits run in the kernel and leave little on-device evidence. For high-risk users whose devices lagged in 2025, arrange a review by a mobile forensics specialist rather than relying on device checks.

Timeline#

  • — Qualcomm publishes its June bulletin, flags limited, targeted exploitation and says OEMs received patches in May.
  • — CISA adds all three CVEs to KEV.
  • — CISA's remediation deadline for federal agencies.
  • — Android Security Bulletin ships CVE-2025-21479 and CVE-2025-27038 at patch level 2025-08-05.

Vulnerability records

  • CVE-2025-21479 · KEV 2025-06-03 · Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
  • CVE-2025-21480 · KEV 2025-06-03 · Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
  • CVE-2025-27038 · KEV 2025-06-03 · Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Qualcomm — June 2025 Security Bulletin docs.qualcomm.com
  2. Android — Android Security Bulletin, August 2025 source.android.com
  3. CVE record — CVE-2025-21479 cve.org
  4. CVE record — CVE-2025-21480 cve.org
  5. CVE record — CVE-2025-27038 cve.org
  6. NVD — CVE-2025-21479 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2025-21479 cisa.gov

Coverage and analysis

  1. BleepingComputer — Qualcomm fixes three Adreno GPU zero-days exploited in attacks bleepingcomputer.com
  2. The Hacker News — Google Fixes 3 Android Vulnerabilities (Aug 2025) thehackernews.com