CVE-2026-21371

Buffer Over-read in WinBlast Driver

Memory Corruption when retrieving output buffer with insufficient size validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 102 more

CVE-2026-21372

Heap-Based Buffer Overflow in Power Management IC

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 54 more

CVE-2026-21373

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21374

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21375

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 68 more

CVE-2026-21376

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21378

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 100 more

CVE-2025-47373

Out-of-bounds Write in Automotive

Memory Corruption when accessing buffers with invalid length during TA invocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 374 more

CVE-2025-47375

Use After Free in Automotive Audio

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 336 more

CVE-2025-47386

Use After Free in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 338 more

CVE-2025-47379

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8031 and 354 more

CVE-2025-47384

Reachable Assertion in FW

Transient DOS when MAC configures config id greater than supported maximum value.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Fastconnect 6200 and 84 more

CVE-2025-47385

Improper Access Control for Register Interface in SCE-Mink

Memory Corruption when accessing trusted execution environment without proper privilege check.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 186 more

CVE-2025-47371

Reachable Assertion in Modem

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 248 more

CVE-2025-47383

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9206 Lte Modem and 410 more

CVE-2025-47376

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 338 more

CVE-2025-47377

Use After Free in Automotive Audio

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 242 more

CVE-2025-59600

Buffer Over-read in Graphics

Memory Corruption when adding user-supplied data without checking available buffer space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 326 more

CVE-2024-53014

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 499 more

CVE-2024-53023

Use After Free in Automotive Android OS

Memory corruption may occur while accessing a variable during extended back to back tests.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6900 and 203 more