#VU110036 Incorrect Authorization in Qualcomm products - CVE-2025-21479

Vulnerability identifier: #VU110036

Vulnerability risk: Critical

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

CVE-ID: CVE-2025-21479

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerable software:
AQT1000
FastConnect 6200
FastConnect 6700
FastConnect 6800
FastConnect 6900
FastConnect 7800
QCA6391
QCM4490
QCS4490
SM4635
SM6250
SM6650
SM6650P
SM7325P
SM7635
SM7675
SM7675P
SM8550P
SM8635
SM8635P
SM8650Q
Snapdragon 4 Gen 1 Mobile Platform
Snapdragon 460 Mobile Platform
Snapdragon 480 5G Mobile Platform
Snapdragon 480+ 5G Mobile Platform (SM4350-AC)
Snapdragon 662 Mobile Platform
Snapdragon 680 4G Mobile Platform
Snapdragon 685 4G Mobile Platform (SM6225-AD)
Snapdragon 690 5G Mobile Platform
Snapdragon 695 5G Mobile Platform
Snapdragon 720G Mobile Platform
Snapdragon 778G 5G Mobile Platform
Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)
Snapdragon 782G Mobile Platform (SM7325-AF)
Snapdragon 7c+ Gen 3 Compute
Snapdragon 8 Gen 2 Mobile Platform
Snapdragon 8 Gen 3 Mobile Platform
Snapdragon 8+ Gen 2 Mobile Platform
Snapdragon 855 Mobile Platform
Snapdragon 855+/860 Mobile Platform (SM8150-AC)
Snapdragon 865 5G Mobile Platform
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 888 5G Mobile Platform
Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
Snapdragon AR1 Gen 1 Platform
Snapdragon AR1 Gen 1 Platform "Luna1"
Snapdragon X55 5G Modem-RF System
SXR2230P
SXR2250P
SXR2330P
WCD9341
WCD9370
WCD9375
WCD9378
WCD9380
WCD9385
WCD9390
WCD9395
WCN3950
WCN3988
WCN6450
WCN6650
WCN6755
WCN7861
WCN7881
WSA8810
WSA8815
WSA8830
WSA8835
WSA8840
WSA8845
WSA8845H
SD855
WSA8832

Software vendor:
Qualcomm

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Graphics. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code.

Note, the vulnerability is being actively exploited in the wild.

Install security update from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html