CVE-2025-47318

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 404 more

CVE-2025-27062

Improper Access Control in Automotive Multimedia

Memory corruption while handling client exceptions, allowing unauthorized channel access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq8064au and 304 more

CVE-2025-27066

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 742 more

CVE-2025-21488

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 214 more

CVE-2025-27049

Buffer Over-read in Camera

Transient DOS while processing IOCTL call for image encoding.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 60 more

CVE-2025-47370

Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csrb31024 and 270 more

CVE-2023-33106

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 306 more

CVE-2023-33107

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

CVSS 3.1 · 8.4 High EPSS 1.0% KEV · Listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq8017 and 484 more

CVE-2024-43047

Use After Free in DSP Service

Memory corruption while maintaining memory maps of HLOS memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6800 and 138 more

CVE-2023-33063

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 8098 and 595 more

CVE-2024-43066

Use After Free in HLOS

Memory corruption while handling file descriptor during listener registration/de-registration.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csrb31024 Csrb31024 Firmware Fastconnect 6200 and 193 more

CVE-2024-43065

Exposed Dangerous Method or Function in HLOS

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 325 more

CVE-2024-43046

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 617 more

CVE-2024-45552

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8064au Apq8064au Firmware Fastconnect 6200 and 289 more

CVE-2024-45551

Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 481 more

CVE-2024-45549

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Information disclosure while creating MQ channels.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 317 more

CVE-2025-21448

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 535 more

CVE-2025-21434

Buffer Over-read in WLAN Host

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 241 more

CVE-2025-21430

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq8017 and 447 more

CVE-2024-33058

Insufficient Granularity of Access Control in Core

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 376 more