CVE-2023-43542

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte Modem 9205 Lte Modem Firmware Aqt1000 and 415 more

CVE-2023-33077

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption in HLOS while converting from authorization token to HIDL vector.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 189 more

CVE-2023-43546

Use After Free in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 237 more

CVE-2025-27055

Buffer Over-read in Camera

Memory corruption during the image encoding process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 77 more

CVE-2023-28554

Buffer Over-read in Qualcomm IPC

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar9380 and 293 more

CVE-2025-27043

Buffer Copy Without Checking Size of Input in Video

Memory corruption while processing manipulated payload in video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 410 more

CVE-2023-43537

Buffer Over-read in WLAN Host

Information disclosure while handling T2LM Action Frame in WLAN Host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 221 more

CVE-2023-43551

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 479 more

CVE-2024-21475

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 469 more

CVE-2023-43536

Buffer Over-read in WLAN Firmware

Transient DOS while parse fils IE with length equal to 1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 615 more

CVE-2023-28556

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 449 more

CVE-2023-43531

Access of Uninitialized Pointer in SPS Applications

Memory corruption while verifying the serialized header when the key pairs are generated.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more

CVE-2023-28545

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 405 more

CVE-2023-43534

Use of Out-of-range Pointer Offset in WLAN HOST

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6900 and 129 more

CVE-2023-43530

Integer Overflow or Wraparound in HLOS

Memory corruption in HLOS while checking for the storage type.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 313 more

CVE-2023-43527

Buffer Over-read in Video

Information disclosure while parsing dts header atom in Video.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 105 more

CVE-2023-21629

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 421 more

CVE-2023-43533

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 473 more

CVE-2023-43529

Reachable Assertion in Data Modem

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 319 more

CVE-2023-43518

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 303 more