CVE-2024-21476

Improper Input Validation in Secure Processor

Memory corruption when the channel ID passed by user is not validated and further used.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 100 more

CVE-2024-43047

Use After Free in DSP Service

Memory corruption while maintaining memory maps of HLOS memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6800 and 138 more

CVE-2025-27042

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 686 more

CVE-2024-33042

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 453 more

CVE-2023-33115

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 333 more

CVE-2024-53009

Improper Validation of Array Index in Automotive Autonomy

Memory corruption while operating the mailbox in Automotive.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 376 more

CVE-2023-33101

Incorrect Type Conversion or Cast in Multi-Mode Call Processor

Transient DOS while processing DL NAS TRANSPORT message with payload length 0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 205 more

CVE-2023-43530

Integer Overflow or Wraparound in HLOS

Memory corruption in HLOS while checking for the storage type.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 313 more

CVE-2023-33086

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 311 more

CVE-2023-33099

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 205 more

CVE-2025-21446

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 478 more

CVE-2023-43551

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 479 more

CVE-2024-43051

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 485 more

CVE-2024-43057

Use After Free in MProc

Memory corruption while processing command in Glink linux.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware C-v2x 9150 and 303 more

CVE-2023-33023

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Memory corruption while processing finish_sign command to pass a rsp buffer.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot and 633 more

CVE-2023-21629

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 421 more

CVE-2023-43555

Buffer Over-read in Video

Information disclosure in Video while parsing mp2 clip with invalid section length.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Aqt1000 and 235 more

CVE-2023-43548

Buffer Copy Without Checking Size of Input in Video

Memory corruption while parsing qcp clip with invalid chunk data size.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 281 more

CVE-2023-28547

Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot and 664 more

CVE-2025-21454

Buffer Over-read in WLAN Embedded SW

Transient DOS while processing received beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 382 more