Qualcomm Wsa8835 Firmware vulnerabilities

CVE-2025-59611 Medium · 6.7 CWE-787 Jun 1, 2026

Out-of-bounds Write in Core Services

Memory corruption in diagnostic services due to absence of input validation

CVE-2025-59610 Medium · 6.4 CWE-367 Jun 1, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVE-2025-59609 Medium · 5.5 CWE-126 Jun 1, 2026

Buffer Over-read in WLAN Host Communication

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

CVE-2025-59606 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in HLOS

Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.

CVE-2025-59605 High · 7.8 CWE-787 Jun 1, 2026

Out-of-bounds Write in HLOS

Memory Corruption when processing device identifier strings that exceed the expected maximum length.

CVE-2025-59604 High · 7.8 CWE-476 Jun 1, 2026

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVE-2025-59601 Medium · 6.5 CWE-1230 Jun 1, 2026

Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.

CVE-2026-25266 High · 7.8 CWE-787 May 4, 2026

Exposed dangerous function in windows host

Memory corruption while processing IOCTL command when device is in power-save state.

CVE-2026-24082 High · 7.8 CWE-416 May 4, 2026

Use After Free in Automotive GPU

Memory Corruption when copying data from a freed source while executing performance counter deselect operation.

CVE-2025-47407 High · 7.0 CWE-367 May 4, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.

CVE-2025-47406 Medium · 5.5 CWE-125 May 4, 2026

Buffer Over-read in DSP Service

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

CVE-2025-47404 High · 7.8 CWE-787 May 4, 2026

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

CVE-2025-47403 High · 7.5 CWE-125 May 4, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

CVE-2025-47401 High · 7.5 CWE-125 May 4, 2026

Buffer Over-read in WLAN HAL

Transient DOS when processing target power rate tables during channel configuration.

CVE-2026-21381 High · 7.5 CWE-126 Apr 6, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

CVE-2026-21380 High · 7.8 CWE-416 Apr 6, 2026

Use After Free in DSP Service

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

CVE-2026-21378 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21376 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

CVE-2026-21375 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21374 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

CVE-2026-21373 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in Camera

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

CVE-2026-21371 High · 7.8 CWE-126 Apr 6, 2026

Buffer Over-read in WinBlast Driver

Memory Corruption when retrieving output buffer with insufficient size validation.

CVE-2026-21367 High · 7.5 CWE-126 Apr 6, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

CVE-2025-47392 High · 8.8 CWE-190 Apr 6, 2026

Integer Overflow or Wraparound in GPS

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

CVE-2025-47391 High · 7.8 CWE-121 Apr 6, 2026

Stack-based Buffer Overflow in Camera Driver

Memory corruption while processing a frame request from user.