CVE-2024-49847

Buffer Over-read in Multi-Mode Call Processor

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 7800 and 91 more

CVE-2023-33025

Buffer Copy without Checking Size of Input in Data Modem

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 45 more

CVE-2024-53025

Integer Overflow or Wraparound in BT Controller

Transient DOS can occur while processing UCI command.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 7800 Fastconnect 7800 Firmware Sm8750 and 33 more

CVE-2022-33256

Improper validation of array index in Multi-mode call processor

Memory corruption due to improper validation of array index in Multi-mode call processor.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Qca6390 and 127 more

CVE-2022-25694

Use of Out-of-range Pointer Offset in MODEM

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8009 Apq8009 Firmware Apq8009w and 413 more

CVE-2022-25709

Use of Out-of-range Pointer Offset in Data Modem

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Qca6174a and 133 more

CVE-2024-43055

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_Linux

Memory corruption while processing camera use case IOCTL call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 25 more

CVE-2024-43060

Use of Out-of-range Pointer Offset in Automotive Audio

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6900 and 79 more

CVE-2024-43061

Use After Free in Audio

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 57 more

CVE-2024-45555

Integer Overflow to Buffer Overflow in Automotive OS Platform

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Msm8996au Msm8996au Firmware Qam8255p and 79 more

CVE-2024-43064

Permissions, Privileges, and Access Controls issue in Automotive OS Platform

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 57 more

CVE-2022-33275

Improper validation of array index in WLAN HAL

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq5053-aa and 515 more

CVE-2022-40534

Improper Validation of Array Index in Audio

Memory corruption due to improper validation of array index in Audio.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Snapdragon W5\+ Gen 1 Wearable Platform Snapdragon W5\+ Gen 1 Wearable Platform Firmware Sw5100 and 23 more

CVE-2023-28538

Stack-based Buffer Overflow in WIN Product

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Csra6620 and 257 more

CVE-2023-28544

Buffer Copy without Checking the Size of Input in WLAN Firmware

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar9380 and 409 more

CVE-2023-28548

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 363 more

CVE-2023-28549

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 447 more

CVE-2023-28559

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 423 more

CVE-2023-28560

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

8098 8098 Firmware 8998 and 531 more

CVE-2023-28562

Buffer Copy Without Checking Size of Input in QESL

Memory corruption while handling payloads from remote ESL.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 133 more