Qualcomm Sa8195p Firmware vulnerabilities

CVE-2026-57554 High · 7.8 CWE-416 Oct 6, 2026

Use After Free in DSP Service

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

CVE-2026-57545 High · 7.8 CWE-822 Oct 6, 2026

Untrusted Pointer Dereference in Graphics

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

CVE-2026-25267 High · 7.8 CWE-862 Oct 6, 2026

Missing Authorization in Core

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVE-2026-25263 Medium · 6.6 CWE-787 Oct 6, 2026

Out of Bounds write in Linux Camera

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVE-2026-25278 High · 7.0 CWE-367 Sep 17, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

CVE-2026-25275 High · 7.5 CWE-126 Sep 17, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

CVE-2026-25292 High · 7.6 CWE-1286 Aug 4, 2026

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

CVE-2026-24080 High · 7.8 CWE-120 Aug 4, 2026

Buffer Copy Without Checking Size of Input in Biometrics

Memory Corruption when handling malformed request parameters in the fingerprint TA.

CVE-2026-24077 Medium · 6.5 CWE-191 Aug 4, 2026

Integer Underflow (Wrap or Wraparound) in WLAN Host

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

CVE-2026-21366 High · 7.8 CWE-190 Aug 4, 2026

Integer Overflow or Wraparound in Data Network Stack & Connectivity

Memory corruption while processing a packet with a size close to the maximum allowed value.

CVE-2026-21369 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

CVE-2026-24092 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Display

Memory Corruption when processing fastboot commands to set display mode.

CVE-2026-24091 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption while processing fastboot commands with improperly formatted input.

CVE-2026-24090 High · 7.1 CWE-306 Jun 1, 2026

Missing Authentication for Critical Function in HLOS

Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

CVE-2026-24089 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Kernel

Memory corruption while processing fastboot commands with invalid input.

CVE-2026-24087 High · 7.2 CWE-1286 Jun 1, 2026

Improper Validation of Syntactic Correctness of Input in Kernel

Memory corruption while processing fastboot OEM commands.

CVE-2026-24085 High · 7.2 CWE-121 Jun 1, 2026

Stack-based Buffer Overflow in Display

Memory Corruption when processing display command line information due to improper initialization of a variable.

CVE-2025-59610 Medium · 6.4 CWE-367 Jun 1, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVE-2025-59609 Medium · 5.5 CWE-126 Jun 1, 2026

Buffer Over-read in WLAN Host Communication

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

CVE-2025-59606 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in HLOS

Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.

CVE-2025-59605 High · 7.8 CWE-787 Jun 1, 2026

Out-of-bounds Write in HLOS

Memory Corruption when processing device identifier strings that exceed the expected maximum length.

CVE-2025-59604 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVE-2026-24082 High · 7.8 CWE-416 May 4, 2026

Use After Free in Automotive GPU

Memory Corruption when copying data from a freed source while executing performance counter deselect operation.

CVE-2025-47404 High · 7.8 CWE-787 May 4, 2026

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

CVE-2025-47401 High · 7.5 CWE-125 May 4, 2026

Buffer Over-read in WLAN HAL

Transient DOS when processing target power rate tables during channel configuration.