Qcc711 Firmware CVEs and Security Vulnerabilities

CVE-2026-24081

Buffer Over-read in BT Controller

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware C110100 and 302 more

CVE-2024-38408

Cryptographic Issues in BT Controller

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 470 more

CVE-2025-47317

Buffer Over-read in BT Controller

Memory corruption due to global buffer overflow when a test command uses an invalid payload type.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6200 Fastconnect 6200 Firmware Fastconnect 6700 and 104 more

CVE-2025-27053

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile Platform 215 Mobile Platform Firmware 315 5g Iot Modem and 636 more

CVE-2025-27054

Out-of-bounds Write in Display

Memory corruption while processing a malformed license file during reboot.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 596 more

CVE-2025-21465

Out-of-bounds Read in Core

Information disclosure while processing the hash segment in an MBN file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 696 more

CVE-2025-21464

Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 682 more

CVE-2025-47318

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 404 more

CVE-2023-28587

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 377 more

CVE-2024-38426

Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 325 more

CVE-2023-33072

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 487 more

Search vulnerabilities

Buffer Over-read in BT Controller

Cryptographic Issues in BT Controller

Buffer Over-read in BT Controller

Incorrect Calculation of Buffer Size in HLOS

Out-of-bounds Write in Display

Out-of-bounds Read in Core

Out-of-bounds Read in Core

Buffer Over-read in BT Controller

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Improper Authentication in Modem

Buffer copy without checking size of Input in Core