CVE-2025-21446

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 478 more

CVE-2025-27061

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Aqt1000 and 686 more

CVE-2024-53027

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware Apq8017 and 421 more

CVE-2024-38426

Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 325 more

CVE-2024-43051

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 485 more

CVE-2024-43056

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 382 more

CVE-2025-21433

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Apq8017 and 548 more

CVE-2025-21450

Improper Authentication in GPS_GNSS

Cryptographic issue occurs due to use of insecure connection method while downloading.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 214 more

CVE-2025-27056

Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 7800 Fastconnect 7800 Firmware Qmp1000 and 48 more

CVE-2024-45571

Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 297 more

CVE-2024-49838

Buffer Over-read in WLAN HOST

Information disclosure while parsing the OCI IE with invalid length.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 335 more

CVE-2024-49843

Improper Validation of Array Index in Graphics_Linux

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 7800 and 101 more

CVE-2024-49834

Improper Validation of Array Index in Camera

Memory corruption while power-up or power-down sequence of the camera sensor.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csra6620 Csra6620 Firmware Csra6640 and 251 more

CVE-2024-45582

Improper Validation of Array Index in Camera Driver

Memory corruption while validating number of devices in Camera kernel .

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 65 more

CVE-2024-45584

Untrusted Pointer Dereference in Automotive Android OS

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 245 more

CVE-2024-49833

Improper Validation of Array Index in Camera

Memory corruption can occur in the camera when an invalid CID is used.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 157 more

CVE-2024-43048

Stack-based Buffer Overflow in Performance

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6900 and 101 more

CVE-2024-38424

Use After Free in GPS

Memory corruption during GNSS HAL process initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 237 more

CVE-2024-33033

Use After Free in ComputerVision

Memory corruption while processing IOCTL calls to unmap the buffers.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 53 more

CVE-2024-23377

Use of Out-of-range Pointer Offset in ComputerVision

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 76 more