CVE-2025-21479KEV · OVERDUECWE-863

Incorrect Authorization in Graphics

High · published June 3, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 57.5th percentile for exploit probability.

487
days past CISA
deadline
CVSS v3.1
8.6
EPSS
1%
Percentile
57.5
In the wild
Confirmed
What it is

⚡ A crafty sequence of commands can lead to memory corruption in GPU micronodes! It’s like giving your GPU a faulty recipe and letting it run wild! Think of it as a kitchen where a chef receives a rogue recipe that causes chaos, burning ingredients and ruining dishes—this flaw allows attackers to execute unauthorized commands, potentially leading to catastrophic system issues. An attacker could exploit this vulnerability to cause memory corruption, leading to crashes, data leaks, or even remote code execution. This could compromise sensitive data and disrupt system performance, creating a perfect storm of chaos and inconvenience for users. Talk about a bad day at the office! 🔥

Put simply

Think of it as a kitchen where a chef receives a rogue recipe that causes chaos, burning ingredients and ruining dishes—this flaw allows attackers to execute unauthorized commands, potentially leading to catastrophic system issues. CVE-2025-21479 allows unauthorized command execution in GPU micronodes, leading to potential memory corruption through a specific sequence of commands. This can result in unexpected behavior or system crashes.

What to do

An attacker could exploit this vulnerability to cause memory corruption, leading to crashes, data leaks, or even remote code execution. This could compromise sensitive data and disrupt system performance, creating a perfect storm of chaos and inconvenience for users. Talk about a bad day at the office! 🔥 Update your GPU drivers to the latest version provided by the manufacturer to patch this vulnerability. Additionally, review command sequences executed by your applications to ensure no unauthorized commands are sent. Regularly monitor for updates and alerts related to your GPU software. 🛡️ You've got this! With these steps, you're on your way to locking down your systems and keeping those GPUs in check! 🚀

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00843 · 57.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-06-03T06:42Z
KEV added
2025-06-03 · due 2025-06-24
EPSS history
Timeline
  • 03 JUN 06:42Z
    Incorrect Authorization in Graphics
    cvelistv5
  • 03 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 24
    kev