CVE-2025-27029

Buffer Over-read in WLAN HAL

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 7800 Fastconnect 7800 Firmware Immersive Home 3210 Platform and 131 more

CVE-2024-53019

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 159 more

CVE-2025-27073

Reachable Assertion in WLAN Firmware

Transient DOS while creating NDP instance.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 338 more

CVE-2025-27065

Buffer Over-read in WLAN Firmware

Transient DOS while processing a frame with malformed shared-key descriptor.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6800 and 298 more

CVE-2025-21477

Improper Input Validation in Modem

Transient DOS while processing CCCH data when NW sends data with invalid length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 176 more

CVE-2025-27076

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while processing simultaneous requests via escape path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 88 more

CVE-2025-27067

Improper Validation of Array Index in DSP Service

Memory corruption while processing DDI call with invalid buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 14 more

CVE-2025-27068

Buffer Over-read in Camera

Memory corruption while processing an IOCTL command with an arbitrary address.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6900 and 30 more

CVE-2025-27069

Untrusted Pointer Dereference in DSP Service

Memory corruption while processing DDI command calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 14 more

CVE-2025-27075

Improper Validation of Array Index in Bluetooth HOST

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 70 more

CVE-2023-21673

Improper Access Control in Kernel

Improper Access to the VM resource manager can lead to Memory Corruption.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 323 more

CVE-2024-33041

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 67 more

CVE-2024-33042

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 453 more

CVE-2024-33047

Buffer Over-read in Display

Memory corruption when the captureRead QDCM command is invoked from user-space.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 47 more

CVE-2024-33048

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 391 more

CVE-2024-33050

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 538 more

CVE-2024-33051

Buffer Over-read in WLAN Firmware

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware 315 5g Iot Modem Firmware and 634 more

CVE-2024-33052

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when user provides data for FM HCI command control operations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 453 more

CVE-2024-33054

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 67 more

CVE-2024-33055

Use After Free in Computer Vision

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 75 more