CVE-2025-59610

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware C-v2x 9150 and 470 more

CVE-2025-59604

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 528 more

CVE-2025-59605

Out-of-bounds Write in HLOS

Memory Corruption when processing device identifier strings that exceed the expected maximum length.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 278 more

CVE-2026-24085

Stack-based Buffer Overflow in Display

Memory Corruption when processing display command line information due to improper initialization of a variable.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2026-24088

Missing Authentication for Critical Function in Boot

Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar9380 Ar9380 Firmware Csr8811 and 490 more

CVE-2026-24091

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption while processing fastboot commands with improperly formatted input.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2025-47401

Buffer Over-read in WLAN HAL

Transient DOS when processing target power rate tables during channel configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 488 more

CVE-2025-47403

Buffer Over-read in WLAN Firmware

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 512 more

CVE-2026-21385

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 472 more

CVE-2025-47391

Stack-based Buffer Overflow in Camera Driver

Memory corruption while processing a frame request from user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 200 more

CVE-2025-47392

Integer Overflow or Wraparound in GPS

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 306 more

CVE-2026-21367

Buffer Over-read in WLAN Firmware

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 298 more

CVE-2025-47373

Out-of-bounds Write in Automotive

Memory Corruption when accessing buffers with invalid length during TA invocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 374 more

CVE-2025-47371

Reachable Assertion in Modem

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 248 more

CVE-2025-47383

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9206 Lte Modem and 410 more

CVE-2024-53011

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 163 more

CVE-2024-45553

Use After Free in DSP Services

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more

CVE-2024-45554

Use After Free in DSP Service

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 39 more

CVE-2024-45564

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to incorrect reference count update.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 123 more

CVE-2024-45566

Use After Free in Camera Driver

Memory corruption during concurrent buffer access due to modification of the reference count.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 43 more