CVE-2025-21438

Out-of-bounds Read in Windows WLAN Host

Memory corruption while IOCTL call is invoked from user-space to read board data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 83 more

CVE-2025-21439

Out-of-bounds Read in Windows WLAN Host

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 47 more

CVE-2025-21440

Out-of-bounds Read in Windows WLAN Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 95 more

CVE-2025-21441

Out-of-bounds Read in Windows WLAN Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 95 more

CVE-2025-21481

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption while performing private key encryption in trusted application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 496 more

CVE-2025-21482

Cryptographic Issues in Core

Cryptographic issue while performing RSA PKCS padding decoding.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 572 more

CVE-2025-27032

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 382 more

CVE-2025-47316

Double Free in Video

Memory corruption due to double free when multiple threads race to set the timestamp store.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 56 more

CVE-2025-47327

Use After Free in Camera

Memory corruption while encoding the image data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 80 more

CVE-2025-27053

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile Platform 215 Mobile Platform Firmware 315 5g Iot Modem and 636 more

CVE-2025-27054

Out-of-bounds Write in Display

Memory corruption while processing a malformed license file during reboot.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 596 more

CVE-2025-47387

Untrusted Pointer Dereference in Camera

Memory Corruption when processing IOCTLs for JPEG data without verification.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 88 more

CVE-2023-22388

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 455 more

CVE-2024-53010

Improper Access Control in Core

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 383 more

CVE-2025-21465

Out-of-bounds Read in Core

Information disclosure while processing the hash segment in an MBN file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 696 more

CVE-2025-21464

Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 682 more

CVE-2025-47318

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 404 more

CVE-2025-27066

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 742 more

CVE-2024-43046

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 617 more

CVE-2025-21448

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 535 more