CVE-2026-25266

Exposed dangerous function in windows host

Memory corruption while processing IOCTL command when device is in power-save state.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6900 and 46 more

CVE-2026-21385

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 472 more

CVE-2026-21381

Buffer Over-read in WLAN Firmware

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 204 more

CVE-2025-47374

Use After Free in Camera Driver

Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 58 more

CVE-2025-47389

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 360 more

CVE-2025-47391

Stack-based Buffer Overflow in Camera Driver

Memory corruption while processing a frame request from user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 200 more

CVE-2026-21373

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21374

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21375

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 68 more

CVE-2026-21376

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 106 more

CVE-2026-21378

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Cologne and 100 more

CVE-2026-21380

Use After Free in DSP Service

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6900 and 44 more

CVE-2025-47373

Out-of-bounds Write in Automotive

Memory Corruption when accessing buffers with invalid length during TA invocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 374 more

CVE-2025-47378

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 146 more

CVE-2025-59600

Buffer Over-read in Graphics

Memory Corruption when adding user-supplied data without checking available buffer space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 326 more

CVE-2024-45580

Use After Free in DSP Service

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 71 more

CVE-2024-53011

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 163 more

CVE-2024-53014

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 499 more

CVE-2024-53024

NULL Pointer Dereference in Display

Memory corruption in display driver while detaching a device.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 329 more

CVE-2024-45553

Use After Free in DSP Services

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more