CVE-2025-47316

Double Free in Video

Memory corruption due to double free when multiple threads race to set the timestamp store.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 56 more

CVE-2025-47317

Buffer Over-read in BT Controller

Memory corruption due to global buffer overflow when a test command uses an invalid payload type.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 104 more

CVE-2025-47327

Use After Free in Camera

Memory corruption while encoding the image data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 80 more

CVE-2025-27053

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile Platform 215 Mobile Platform Firmware 315 5g Iot Modem and 636 more

CVE-2025-27054

Out-of-bounds Write in Display

Memory corruption while processing a malformed license file during reboot.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 596 more

CVE-2025-47351

Integer Overflow or Wraparound in DSP Service

Memory corruption while processing user buffers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 54 more

CVE-2025-47354

Use After Free in DSP Service

Memory corruption while allocating buffers in DSP service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 74 more

CVE-2025-27070

Out-of-bounds Write in Windows Compute

Memory corruption while performing encryption and decryption commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 348 more

CVE-2025-47359

Use After Free in Secure Processor

Memory Corruption when multiple threads simultaneously access a memory free API.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 72 more

CVE-2025-47366

Exposed Dangerous Method or Function in HLOS

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 316 more

CVE-2025-47397

Improper Release of Memory Before Removing Last Reference in Graphics

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Csra6620 and 292 more

CVE-2025-47398

Use After Free in Graphics

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Csra6620 and 304 more

CVE-2023-22668

Use After Free in Audio

Memory Corruption in Audio while invoking IOCTLs calls from the user-space.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 109 more

CVE-2023-28546

Buffer Copy Without Checking Size of Input in SPS Applications

Memory Corruption in SPS Application while exporting public key in sorter TA.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 557 more

CVE-2023-28585

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 559 more

CVE-2025-21427

Buffer Over-read in Data HLOS - LNX

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 355 more

CVE-2025-47320

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9206 Lte Modem 9206 Lte Modem Firmware Apq8017 and 424 more

CVE-2025-21484

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8064au Apq8064au Firmware Aqt1000 and 344 more

CVE-2025-21449

Buffer Over-read in WLAN Embedded SW

Transient DOS may occur while processing malformed length field in SSID IEs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Apq8017 and 368 more

CVE-2025-27063

Use After Free in Video

Memory corruption during video playback when video session open fails with time out error.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csra6620 Csra6620 Firmware Csra6640 and 220 more