CVE-2025-47386

Use After Free in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 338 more

CVE-2025-47379

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8031 and 354 more

CVE-2025-47378

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Cologne Cologne Firmware Fastconnect 6700 and 146 more

CVE-2025-47384

Reachable Assertion in FW

Transient DOS when MAC configures config id greater than supported maximum value.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Fastconnect 6200 and 84 more

CVE-2025-47385

Improper Access Control for Register Interface in SCE-Mink

Memory Corruption when accessing trusted execution environment without proper privilege check.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 186 more

CVE-2025-47371

Reachable Assertion in Modem

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 248 more

CVE-2025-47383

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9206 Lte Modem and 410 more

CVE-2025-47376

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 338 more

CVE-2025-59600

Buffer Over-read in Graphics

Memory Corruption when adding user-supplied data without checking available buffer space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Ar8035 and 326 more

CVE-2024-53011

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 163 more

CVE-2024-53014

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 499 more

CVE-2024-53024

NULL Pointer Dereference in Display

Memory corruption in display driver while detaching a device.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 329 more

CVE-2025-21424

Use After Free in NPU

Memory corruption while calling the NPU driver APIs concurrently.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 475 more

CVE-2024-21464

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption while processing IPA statistics, when there are no active clients registered.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 39 more

CVE-2024-45553

Use After Free in DSP Services

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more

CVE-2024-45569

Improper Validation of Array Index in WLAN Host Communication

Memory corruption while parsing the ML IE due to invalid frame content.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 345 more

CVE-2024-49835

Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 421 more

CVE-2024-49841

Detection of Error Condition Without Action in Hypervisor

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 343 more

CVE-2024-49842

Improper Access Control in Hypervisor

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 355 more

CVE-2024-49844

Improper Input Validation in Automotive

Memory corruption while triggering commands in the PlayReady Trusted application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 359 more