Qualcomm Qca0000 Firmware vulnerabilities

CVE-2025-59604 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVE-2025-47408 High · 7.8 CWE-119 May 4, 2026

Untrusted Pointer Dereference in Power Optimization Firmware

Memory corruption when another driver calls an IOCTL with invalid input/output buffer.

CVE-2025-47406 Medium · 5.5 CWE-125 May 4, 2026

Buffer Over-read in DSP Service

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

CVE-2025-47405 High · 7.8 CWE-119 May 4, 2026

Untrusted Pointer Dereference in Camera

Memory corruption when processing camera sensor input/output control codes with invalid output buffers.

CVE-2025-47403 High · 7.5 CWE-125 May 4, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

CVE-2025-47401 High · 7.5 CWE-125 May 4, 2026

Buffer Over-read in WLAN HAL

Transient DOS when processing target power rate tables during channel configuration.

CVE-2026-21382 High · 7.8 CWE-120 Apr 6, 2026

Buffer Copy Without Checking Size of Input in Power Management IC

Memory Corruption when handling power management requests with improperly sized input/output buffers.

CVE-2026-21380 High · 7.8 CWE-416 Apr 6, 2026

Use After Free in DSP Service

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

CVE-2026-21378 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21376 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21375 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21374 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVE-2026-21373 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21371 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in WinBlast Driver

Memory Corruption when retrieving output buffer with insufficient size validation.

CVE-2025-47390 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory corruption while preprocessing IOCTL request in JPEG driver.

CVE-2025-59603 High · 7.8 CWE-787 Mar 2, 2026

Out-of-bounds Write in Computer Vision

Memory Corruption when processing invalid user address with nonstandard buffer address.

CVE-2025-47373 High · 7.8 CWE-787 Mar 2, 2026

Out-of-bounds Write in Automotive

Memory Corruption when accessing buffers with invalid length during TA invocation.

CVE-2025-47356 High · 7.8 CWE-415 Jan 7, 2026

Double Free in Video

Memory Corruption when multiple threads concurrently access and modify shared resources.

CVE-2025-47343 High · 7.8 CWE-822 Jan 7, 2026

Untrusted Pointer Dereference in Video

Memory corruption while processing a video session to set video parameters.

CVE-2025-47331 Medium · 6.1 CWE-126 Jan 7, 2026

Buffer Over-read in Video

Information disclosure while processing a firmware event.

CVE-2025-47350 High · 7.8 CWE-787 Dec 18, 2025

Use After Free in DSP Service

Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.

CVE-2025-27064 Medium · 6.1 CWE-126 Nov 4, 2025

Buffer Over-read in Core Services

Information disclosure while registering commands from clients with diag through diagHal.