CVE-2025-27042

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 686 more

CVE-2025-27057

Buffer Over-read in WLAN Host

Transient DOS while handling beacon frames with invalid IE header length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 419 more

CVE-2025-27030

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Qam8295p and 80 more

CVE-2024-53019

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 159 more

CVE-2024-53013

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 117 more

CVE-2025-21431

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Information disclosure may be there when a guest VM is connected.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 69 more

CVE-2025-21474

Use After Free in BTHOST

Memory corruption while processing commands from A2dp sink command queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 88 more

CVE-2025-27072

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

Information disclosure while processing a packet at EAVB BE side with invalid header length.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 70 more

CVE-2024-21459

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 349 more

CVE-2023-33087

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core

Memory corruption in Core while processing RX intent request.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq5053-aa Apq5053-aa Firmware Ar8035 and 233 more

CVE-2024-33048

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 391 more

CVE-2023-33017

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 551 more

CVE-2024-21475

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 315 5g Iot Modem and 469 more

CVE-2024-33042

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 453 more

CVE-2023-28586

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 623 more

CVE-2023-21673

Improper Access Control in Kernel

Improper Access to the VM resource manager can lead to Memory Corruption.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 323 more

CVE-2024-38397

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing probe response and assoc response frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 231 more

CVE-2023-33022

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq5053-aa and 421 more

CVE-2023-33077

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption in HLOS while converting from authorization token to HIDL vector.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 189 more

CVE-2023-28580

Buffer Copy Without Checking Size of Input in WLAN Host

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6900 and 85 more