CVE-2025-21452

Reachable Assertion in Modem

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 158 more

CVE-2025-21474

Use After Free in BTHOST

Memory corruption while processing commands from A2dp sink command queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 88 more

CVE-2025-27071

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption while processing specific files in Powerline Communication Firmware.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 66 more

CVE-2025-27076

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while processing simultaneous requests via escape path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 88 more

CVE-2025-27075

Improper Validation of Array Index in Bluetooth HOST

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 70 more

CVE-2024-21459

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 349 more

CVE-2023-24855

Use of Out-of-range Pointer Offset in Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 123 more

CVE-2025-27052

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while processing data packets in diag received from Unix clients.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 310 more

CVE-2023-33086

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 311 more

CVE-2024-43056

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 382 more

CVE-2023-33079

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while running invalid audio recording from ADSP.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq5053-aa Apq5053-aa Firmware Ar8035 and 285 more

CVE-2023-43542

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte Modem 9205 Lte Modem Firmware Aqt1000 and 415 more

CVE-2024-45558

Buffer Over-read in WLAN Host Cmn

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 363 more

CVE-2023-33115

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 333 more

CVE-2023-33069

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9206 Lte Modem 9206 Lte Modem Firmware Aqt1000 and 223 more

CVE-2023-33114

Use after free in Neural Processing Unit

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 221 more

CVE-2024-23369

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 234 more

CVE-2023-33098

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 523 more

CVE-2023-43533

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 473 more

CVE-2023-24849

Buffer Over-read in Data Modem

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 473 more