CVE-2023-28586

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 623 more

CVE-2023-43518

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 303 more

CVE-2023-33066

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while processing RT proxy port register driver.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 623 more

CVE-2024-33052

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when user provides data for FM HCI command control operations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 453 more

CVE-2023-28547

Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot and 664 more

CVE-2023-22387

Use of Out-of-range Pointer Offset in Qualcomm IPC

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 539 more

CVE-2023-33092

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 187 more

CVE-2023-33070

Improper Authentication in Automotive OS

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq5053-aa Apq5053-aa Firmware Aqt1000 and 201 more

CVE-2023-24854

Stack-based Buffer Overflow in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware Ar8035 and 323 more

CVE-2023-21631

Improper Input Validation in Modem

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 317 more

CVE-2023-22385

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 479 more

CVE-2023-43511

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 709 more

CVE-2023-22386

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware Ar8035 and 399 more

CVE-2025-21433

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Apq8017 and 548 more

CVE-2023-33023

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Memory corruption while processing finish_sign command to pass a rsp buffer.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot and 633 more

CVE-2024-33060

Use After Free in DSP Service

Memory corruption when two threads try to map and unmap a single node simultaneously.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot and 537 more

CVE-2023-28588

Integer Overflow or Wraparound in Bluetooth Host

Transient DOS in Bluetooth Host while rfc slot allocation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 425 more

CVE-2023-33079

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while running invalid audio recording from ADSP.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq5053-aa Apq5053-aa Firmware Ar8035 and 285 more

CVE-2024-33042

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 453 more

CVE-2023-43513

Use of Out-of-range Pointer Offset in PCIe

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq8017 and 531 more