CVE-2026-25302

Improper Verification of Cryptographic Signature in Boot

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 582 more

CVE-2026-24084

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Aqt1000 and 254 more

CVE-2025-47392

Integer Overflow or Wraparound in GPS

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 306 more

CVE-2025-47371

Reachable Assertion in Modem

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware Ar8035 and 248 more

CVE-2025-47383

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware 9206 Lte Modem and 410 more

CVE-2025-21482

Cryptographic Issues in Core

Cryptographic issue while performing RSA PKCS padding decoding.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 572 more

CVE-2025-27034

Improper Validation of Array Index in Multi-Mode Call Processor

Memory corruption while selecting the PLMN from SOR failed list.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 224 more

CVE-2025-47323

Integer Overflow or Wraparound in Audio

Memory corruption while routing GPR packets between user and root when handling large data packet.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 354 more

CVE-2025-21465

Out-of-bounds Read in Core

Information disclosure while processing the hash segment in an MBN file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 696 more

CVE-2025-21464

Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 682 more

CVE-2024-43046

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 617 more

CVE-2024-45549

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Information disclosure while creating MQ channels.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 317 more

CVE-2024-23362

Improper Input Validation in Trusted Execution Environment

Cryptographic issue while parsing RSA keys in COBR format.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte Modem 9205 Lte Modem Firmware Aqt1000 and 463 more

CVE-2024-23359

Buffer Over-read in Multi Mode Call Processor

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 315 5g Iot Modem and 321 more

CVE-2023-28578

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 677 more

CVE-2024-38426

Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 325 more

CVE-2024-33056

Buffer Over-read in MProc

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 315 5g Iot Modem and 659 more

CVE-2024-23352

Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 208 more

CVE-2024-23353

Buffer Over-read in Multi Mode Call Processor

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 215 Mobile Platform and 499 more

CVE-2024-21465

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing key blob passed by the user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte Modem 9205 Lte Modem Firmware Aqt1000 and 515 more