CVE-2024-33016

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 666 more

CVE-2025-47328

Buffer Over-read in WLAN HAL

Transient DOS while processing power control requests with invalid antenna or stream values.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 7800 Fastconnect 7800 Firmware Immersive Home 3210 Platform and 132 more

CVE-2025-47326

Buffer Over-read in WLAN HAL

Transient DOS while handling command data during power control processing.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 238 more

CVE-2025-27042

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 686 more

CVE-2025-27057

Buffer Over-read in WLAN Host

Transient DOS while handling beacon frames with invalid IE header length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 419 more

CVE-2025-27030

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Qam8295p and 80 more

CVE-2025-27029

Buffer Over-read in WLAN HAL

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 7800 Fastconnect 7800 Firmware Immersive Home 3210 Platform and 131 more

CVE-2024-53013

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 117 more

CVE-2025-27073

Reachable Assertion in WLAN Firmware

Transient DOS while creating NDP instance.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 338 more

CVE-2025-27065

Buffer Over-read in WLAN Firmware

Transient DOS while processing a frame with malformed shared-key descriptor.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6800 and 298 more

CVE-2024-45556

Improper Access Control for Register Interface in TZ Firmware

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 118 more

CVE-2025-21474

Use After Free in BTHOST

Memory corruption while processing commands from A2dp sink command queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 88 more

CVE-2024-21459

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 349 more

CVE-2023-43552

Use After Free in WLAN Host Communication

Memory corruption while processing MBSSID beacon containing several subelement IE.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 295 more

CVE-2023-33028

Buffer Copy without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 349 more

CVE-2023-33109

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 617 more

CVE-2023-28588

Integer Overflow or Wraparound in Bluetooth Host

Transient DOS in Bluetooth Host while rfc slot allocation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 425 more

CVE-2023-43555

Buffer Over-read in Video

Information disclosure in Video while parsing mp2 clip with invalid section length.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Aqt1000 and 235 more

CVE-2023-33027

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 8098 and 680 more

CVE-2023-33053

Improper Validation of Array Index in Kernel

Memory corruption in Kernel while parsing metadata.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csr8811 Csr8811 Firmware Immersive Home 214 Platform and 231 more