CVE-2024-23384

Use After Free in Graphics Linux

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 208 more

CVE-2026-25267

Missing Authorization in Core

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9205 Lte Modem and 330 more

CVE-2026-25263

Out of Bounds write in Linux Camera

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9205 Lte Modem and 330 more

CVE-2026-25275

Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Aqt1000 and 750 more

CVE-2025-59610

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware C-v2x 9150 and 470 more

CVE-2026-24085

Stack-based Buffer Overflow in Display

Memory Corruption when processing display command line information due to improper initialization of a variable.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2026-24091

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption while processing fastboot commands with improperly formatted input.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2026-21385

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 472 more

CVE-2025-47383

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9206 Lte Modem and 410 more

CVE-2024-49848

Use After Free in DSP Service

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 291 more

CVE-2025-21482

Cryptographic Issues in Core

Cryptographic issue while performing RSA PKCS padding decoding.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 572 more

CVE-2025-27032

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 382 more

CVE-2025-27053

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile Platform 215 Mobile Platform Firmware 315 5g Iot Modem and 636 more

CVE-2023-28546

Buffer Copy Without Checking Size of Input in SPS Applications

Memory Corruption in SPS Application while exporting public key in sorter TA.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 557 more

CVE-2023-28585

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 559 more

CVE-2025-47320

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9206 Lte Modem 9206 Lte Modem Firmware Apq8017 and 424 more

CVE-2025-21484

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8064au Apq8064au Firmware Aqt1000 and 344 more

CVE-2025-47333

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 476 more

CVE-2023-22388

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 455 more

CVE-2024-53010

Improper Access Control in Core

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 383 more