CVE-2025-47389

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 360 more

CVE-2025-47390

Buffer Over-read in Camera

Memory corruption while preprocessing IOCTL request in JPEG driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 56 more

CVE-2026-21367

Buffer Over-read in WLAN Firmware

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 298 more

CVE-2026-21371

Buffer Over-read in WinBlast Driver

Memory Corruption when retrieving output buffer with insufficient size validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 102 more

CVE-2026-21373

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21374

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21375

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 68 more

CVE-2026-21376

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21378

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 100 more

CVE-2026-21380

Use After Free in DSP Service

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6900 and 44 more

CVE-2026-21382

Buffer Copy Without Checking Size of Input in Power Management IC

Memory Corruption when handling power management requests with improperly sized input/output buffers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6900 and 36 more

CVE-2024-33065

Improper Input Validation in Camera

Memory corruption while taking snapshot when an offset variable is set by camera driver.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 88 more

CVE-2025-47373

Out-of-bounds Write in Automotive

Memory Corruption when accessing buffers with invalid length during TA invocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 374 more

CVE-2025-59603

Out-of-bounds Write in Computer Vision

Memory Corruption when processing invalid user address with nonstandard buffer address.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6900 and 56 more

CVE-2025-59600

Buffer Over-read in Graphics

Memory Corruption when adding user-supplied data without checking available buffer space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 326 more

CVE-2024-53011

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 163 more

CVE-2024-53033

Untrusted Pointer Dereference in DSP_Services

Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 13 more

CVE-2024-53034

Untrusted Pointer Dereference in DSP_Services

Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 13 more

CVE-2024-49835

Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 421 more

CVE-2024-49841

Detection of Error Condition Without Action in Hypervisor

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 343 more