Qualcomm Snapdragon 7c+ Gen 3 Compute Firmware vulnerabilities

CVE-2025-59604 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVE-2025-47406 Medium · 5.5 CWE-125 May 4, 2026

Buffer Over-read in DSP Service

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

CVE-2025-47404 High · 7.8 CWE-787 May 4, 2026

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

CVE-2026-21378 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21376 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21375 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21374 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVE-2026-21373 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21372 High · 7.8 CWE-122 Apr 6, 2026

Heap-Based Buffer Overflow in Power Management IC

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

CVE-2026-21371 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in WinBlast Driver

Memory Corruption when retrieving output buffer with insufficient size validation.

CVE-2025-47392 High · 8.8 CWE-190 Apr 6, 2026

Integer Overflow or Wraparound in GPS

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

CVE-2025-47390 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory corruption while preprocessing IOCTL request in JPEG driver.

CVE-2025-47389 High · 7.8 CWE-120 Apr 6, 2026

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

CVE-2026-21385 High · 7.8 KEV High · 58 Public exploit CWE-190 Mar 2, 2026

Qualcomm Multiple Chipsets Memory Corruption Vulnerability

Memory corruption while using alignments for memory allocation.

CVE-2025-47386 High · 7.8 CWE-416 Mar 2, 2026

Use After Free in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

CVE-2025-47384 Medium · 6.5 CWE-617 Mar 2, 2026

Reachable Assertion in FW

Transient DOS when MAC configures config id greater than supported maximum value.

CVE-2025-47383 High · 7.2 CWE-325 Mar 2, 2026

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

CVE-2025-47379 High · 7.8 CWE-416 Mar 2, 2026

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

CVE-2025-47376 High · 7.8 CWE-416 Mar 2, 2026

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

CVE-2025-47375 High · 7.8 CWE-416 Mar 2, 2026

Use After Free in Automotive Audio

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

CVE-2025-47369 Medium · 5.5 CWE-200 Jan 7, 2026

Information Exposure in Computer Vision

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

CVE-2025-47348 High · 7.8 CWE-457 Jan 7, 2026

Use of Uninitialized Variable in HLOS

Memory corruption while processing identity credential operations in the trusted application.

CVE-2025-47334 Medium · 6.7 CWE-120 Jan 7, 2026

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

CVE-2025-47333 Medium · 6.6 CWE-416 Jan 7, 2026

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

CVE-2025-47331 Medium · 6.1 CWE-126 Jan 7, 2026

Buffer Over-read in Video

Information disclosure while processing a firmware event.