CVE-2025-47401

Buffer Over-read in WLAN HAL

Transient DOS when processing target power rate tables during channel configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 488 more

CVE-2025-47403

Buffer Over-read in WLAN Firmware

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Cologne and 512 more

CVE-2024-45553

Use After Free in DSP Services

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 253 more

CVE-2024-45554

Use After Free in DSP Service

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 39 more

CVE-2024-45564

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to incorrect reference count update.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 123 more

CVE-2024-45566

Use After Free in Camera Driver

Memory corruption during concurrent buffer access due to modification of the reference count.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 43 more

CVE-2024-45567

Use After Free in Camera Driver

Memory corruption while encoding JPEG format.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 25 more

CVE-2024-45575

Integer Overflow or Wraparound in Camera Driver

Memory corruption Camera kernel when large number of devices are attached through userspace.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 25 more

CVE-2024-45576

Improper Validation of Array Index in Camera Driver

Memory corruption while prociesing command buffer buffer in OPE module.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 35 more

CVE-2024-45577

Improper Input Validation in Camera Driver

Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 17 more

CVE-2024-45578

Improper Validation of Array Index in Camera Driver

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 25 more

CVE-2024-45579

Improper Input Validation in Camera Driver

Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 17 more

CVE-2024-49829

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera

Memory corruption can occur during context user dumps due to inadequate checks on buffer length.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6900 Fastconnect 6900 Firmware Fastconnect 7800 and 17 more

CVE-2024-49835

Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 421 more

CVE-2024-49841

Detection of Error Condition Without Action in Hypervisor

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 343 more

CVE-2024-49842

Improper Access Control in Hypervisor

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 355 more

CVE-2024-49844

Improper Input Validation in Automotive

Memory corruption while triggering commands in the PlayReady Trusted application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 359 more

CVE-2024-49845

Improper Input Validation in HLOS

Memory corruption during the FRS UDS generation process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 289 more

CVE-2025-21453

Use After Free in GPS HLOS Driver

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile 205 Mobile Firmware 215 Mobile and 529 more

CVE-2025-21467

Out-of-bounds Write in Computer Vision

Memory corruption while reading the FW response from the shared queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

215 Mobile 215 Mobile Firmware Csra6620 and 209 more