CVE-2025-27047

Use After Free in Display

Memory corruption while processing the TESTPATTERNCONFIG escape path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 38 more

CVE-2025-27050

Use After Free in Camera

Memory corruption while processing event close when client process terminates abruptly.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 78 more

CVE-2025-27052

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while processing data packets in diag received from Unix clients.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 310 more

CVE-2025-27055

Buffer Over-read in Camera

Memory corruption during the image encoding process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 77 more

CVE-2025-27061

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Aqt1000 and 686 more

CVE-2024-45560

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 71 more

CVE-2024-45571

Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 297 more

CVE-2024-45573

Use of Out-of-range Pointer Offset in Display

Memory corruption may occour while generating test pattern due to negative indexing of display ID.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 45 more

CVE-2024-49838

Buffer Over-read in WLAN HOST

Information disclosure while parsing the OCI IE with invalid length.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 335 more

CVE-2024-49834

Improper Validation of Array Index in Camera

Memory corruption while power-up or power-down sequence of the camera sensor.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csra6620 Csra6620 Firmware Csra6640 and 251 more

CVE-2024-38420

Improper Input Validation in Hypervisor

Memory corruption while configuring a Hypervisor based input virtual device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 317 more

CVE-2024-33043

Buffer Over-read in FM Host

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 215 Mobile Platform and 403 more

CVE-2024-43050

Stack-based Buffer Overflow in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 106 more

CVE-2024-33056

Buffer Over-read in MProc

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 315 5g Iot Modem and 659 more

CVE-2024-33044

Improper Validation of Array Index in Hypervisor

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 422 more

CVE-2024-33012

Buffer Over-read in WLAN Host

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 498 more

CVE-2024-33013

Buffer Over-read in WLAN Host

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 339 more

CVE-2024-33011

Buffer Over-read in WLAN Host

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 498 more

CVE-2024-33010

Use After Free in WLAN Host

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 496 more

CVE-2024-23383

Use After Free in Graphics Linux

Memory corruption when kernel driver attempts to trigger hardware fences.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 142 more