CVE-2025-21477

Improper Input Validation in Modem

Transient DOS while processing CCCH data when NW sends data with invalid length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 176 more

CVE-2025-21452

Reachable Assertion in Modem

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 158 more

CVE-2024-45556

Improper Access Control for Register Interface in TZ Firmware

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 118 more

CVE-2025-21431

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Information disclosure may be there when a guest VM is connected.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 69 more

CVE-2025-21457

Buffer Over-read in Automotive OS Platform Android

Information disclosure while opening a fastrpc session when domain is not sanitized.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Google Qualcomm

Products

Android Ar8035 Ar8035 Firmware and 29 more

CVE-2025-21474

Use After Free in BTHOST

Memory corruption while processing commands from A2dp sink command queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 88 more

CVE-2025-27071

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption while processing specific files in Powerline Communication Firmware.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 66 more

CVE-2025-27076

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while processing simultaneous requests via escape path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 88 more

CVE-2025-21472

Leftover Debug Code in Secure Element

Information disclosure while capturing logs as eSE debug messages are logged.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 22 more

CVE-2025-27067

Improper Validation of Array Index in DSP Service

Memory corruption while processing DDI call with invalid buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 14 more

CVE-2025-27068

Buffer Over-read in Camera

Memory corruption while processing an IOCTL command with an arbitrary address.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6900 and 30 more

CVE-2025-27069

Untrusted Pointer Dereference in DSP Service

Memory corruption while processing DDI command calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 14 more

CVE-2025-27072

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

Information disclosure while processing a packet at EAVB BE side with invalid header length.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 70 more

CVE-2025-27075

Improper Validation of Array Index in Bluetooth HOST

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 70 more

CVE-2025-47324

Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware

Information disclosure while accessing and modifying the PIB file of a remote device via powerline.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qca7005 Qca7005 Firmware Snapdragon

CVE-2024-21459

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 349 more

CVE-2024-21468

Use After Free in Kernel

Memory corruption when there is failed unmap operation in GPU.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 457 more

CVE-2023-43542

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte Modem 9205 Lte Modem Firmware Aqt1000 and 415 more

CVE-2023-33109

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 617 more

CVE-2023-33064

Buffer Over-read in Audio

Transient DOS in Audio when invoking callback function of ASM driver.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 175 more