CVE-2026-25267

Missing Authorization in Core

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9205 Lte Modem and 330 more

CVE-2026-25263

Out of Bounds write in Linux Camera

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9205 Lte Modem and 330 more

CVE-2026-25275

Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Aqt1000 and 750 more

CVE-2024-38408

Cryptographic Issues in BT Controller

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 470 more

CVE-2022-33252

Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 319 more

CVE-2025-59610

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware C-v2x 9150 and 470 more

CVE-2026-24085

Stack-based Buffer Overflow in Display

Memory Corruption when processing display command line information due to improper initialization of a variable.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2026-24091

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption while processing fastboot commands with improperly formatted input.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 544 more

CVE-2025-47404

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware 5g Fixed Wireless Access and 374 more

CVE-2026-21385

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Apq8098 and 472 more

CVE-2025-47379

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8031 and 354 more

CVE-2024-53011

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 163 more

CVE-2024-53014

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 499 more

CVE-2024-53028

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks

Memory corruption may occur while processing message from frontend during allocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Qam8255p Qam8255p Firmware Qam8295p and 69 more

CVE-2024-53030

Improper Input Validation in Automotive OS Platform

Memory corruption while processing input message passed from FE driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Msm8996au Msm8996au Firmware Qam8255p and 85 more

CVE-2025-21424

Use After Free in NPU

Memory corruption while calling the NPU driver APIs concurrently.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 215 Firmware 315 5g Iot Modem and 475 more

CVE-2024-49835

Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 421 more

CVE-2024-49841

Detection of Error Condition Without Action in Hypervisor

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 343 more

CVE-2024-49842

Improper Access Control in Hypervisor

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 355 more

CVE-2024-49844

Improper Input Validation in Automotive

Memory corruption while triggering commands in the PlayReady Trusted application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 359 more