CVE-2025-21480KEV · OVERDUECWE-863

Incorrect Authorization in Graphics Windows

High · published June 3, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 38.9th percentile for exploit probability.

487
days past CISA
deadline
CVSS v3.1
8.6
EPSS
0%
Percentile
38.9
In the wild
Confirmed
What it is

🚨 A crafty sequence of commands can trigger memory corruption in GPU micronodes! This vulnerability is a high-stakes game that attackers are already exploiting! ⚡ Think of it like a factory assembly line going haywire because a worker mistakenly skips a crucial step — a tiny oversight could lead to a catastrophic failure of the entire production process. When commands are executed out of order, it’s like sending the wrong components to assembly, creating chaos! An attacker can manipulate this flaw to execute unauthorized commands, potentially leading to system crashes, data corruption, or even a complete takeover of the GPU. Imagine your graphics-intensive applications suddenly failing, putting important projects at risk!

Put simply

Think of it like a factory assembly line going haywire because a worker mistakenly skips a crucial step — a tiny oversight could lead to a catastrophic failure of the entire production process. When commands are executed out of order, it’s like sending the wrong components to assembly, creating chaos! This vulnerability arises from a failure to properly validate command execution sequences in GPU micronodes, leading to memory corruption that can be exploited by attackers to run arbitrary code.

What to do

An attacker can manipulate this flaw to execute unauthorized commands, potentially leading to system crashes, data corruption, or even a complete takeover of the GPU. Imagine your graphics-intensive applications suddenly failing, putting important projects at risk! To mitigate this vulnerability, ensure all relevant systems are patched to the latest version provided by the vendor. Additionally, review your command execution sequences to validate their integrity and security. Don't wait too long—act fast! You've got this! With a few quick updates, you'll secure your systems and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-06-03T05:53Z
KEV added
2025-06-03 · due 2025-06-24
EPSS history
Timeline
  • 03 JUN 05:53Z
    Incorrect Authorization in Graphics Windows
    cvelistv5
  • 03 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 24
    kev