Pierluigi Paganini June 02, 2025

Qualcomm addressed three zero-day vulnerabilities that, according to the company, have been exploited in limited, targeted attacks in the wild.

Google Android Security team reported the three issues, tracked as CVE-2025-21479, CVE-2025-21480, CVE-2025-27038, to the company.

“There are indications from Google Threat Analysis Group that CVE-2025-21479, CVE-2025-21480, CVE-2025-27038 may be under limited, targeted exploitation.” reads the report published by the vendor. “Patches for the issues affecting the Adreno Graphics Processing Unit (GPU) driver have been made available to OEMs in May together with a strong recommendation to deploy the update on affected devices as soon as possible.”

Below are the descriptions of these vulnerabilities:

• CVE-2025-21479 (CVSS score: 8.6) – The flaw is an Incorrect Authorization issue in the Graphics component. “Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.” reads the advisory.
• CVE-2025-21480 (CVSS score: 8.6) – The flaw is an Incorrect Authorization issue in Graphics Windows. “Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.” reads the advisory.
• CVE-2025-27038 (CVSS score: 7.5) – The flaw is a use-after-free issue in the Graphics component. “Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.” states the advisory.

The company did not share details about the attacks exploiting the three vulnerabilities.

In October 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2024-43047 Qualcomm Multiple Chipsets Use-After-Free Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability stems from a use-after-free bug that could lead to memory corruption. The zero-day vulnerability resides in the Digital Signal Processor (DSP) service and impacts dozens of chipsets.

The flaw was reported by cybersecurity researchers Seth Jenkins from Google Project Zero and Conghui Wang from Amnesty International Security Lab. Jenkins recommended addressing the issue on Android devices as soon as possible.

Google Threat Analysis Group revealed that CVE-2024-43047 was under limited, targeted exploitation, Wang also confirmed in-the-wild activity. 

The researchers did not publish details about the attacks exploiting the CVE-2024-43047, however, the reporting organizations are known for investigating cyberattacks linked to commercial spyware vendors.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)