CVE-2025-27030

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Qam8295p and 80 more

CVE-2024-53013

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 117 more

CVE-2025-21472

Leftover Debug Code in Secure Element

Information disclosure while capturing logs as eSE debug messages are logged.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 22 more

CVE-2024-33045

Return of Stack Variable Address in Buses

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 382 more

CVE-2024-53009

Improper Validation of Array Index in Automotive Autonomy

Memory corruption while operating the mailbox in Automotive.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 376 more

CVE-2023-43531

Access of Uninitialized Pointer in SPS Applications

Memory corruption while verifying the serialized header when the key pairs are generated.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more

CVE-2024-33050

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 538 more

CVE-2024-33067

Buffer Over-read in Audio

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware C-v2x 9150 and 151 more

CVE-2024-43051

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 485 more

CVE-2024-33057

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 353 more

CVE-2024-33049

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csr8811 Csr8811 Firmware Fastconnect 6700 and 259 more

CVE-2024-49839

Buffer Over-read in WLAN Host Cmn

Memory corruption during management frame processing due to mismatch in T2LM info element.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 369 more

CVE-2024-21480

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Memory corruption while playing audio file having large-sized input buffer.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 227 more

CVE-2024-53027

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware Apq8017 and 421 more

CVE-2025-27061

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Aqt1000 and 686 more

CVE-2024-45562

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to unprotected critical field.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 157 more

CVE-2024-21475

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 469 more

CVE-2024-21471

Use After Free in Graphics Linux

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 347 more

CVE-2025-21433

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Apq8017 and 548 more

CVE-2024-23369

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 234 more