Qualcomm vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Qualcomm products: 207 record(s), with severity, exploitation and fixes.

Snapdragon 202 Fastconnect 7800 Firmware 171 Wcd9380 Firmware 163 Wcd9385 Firmware 163 Wsa8845 Firmware 161 Wsa8840 Firmware 161 Wsa8845h Firmware 161 Fastconnect 6900 Firmware 159 Wsa8835 Firmware 146 Wsa8830 Firmware 144 Wcd9370 Firmware 137 Wcd9375 Firmware 136 Fastconnect 6700 Firmware 128 Wsa8810 Firmware 122 Wsa8815 Firmware 122 Wsa8832 Firmware 119 Wcn3988 Firmware 113 Wcn3950 Firmware 111 Video Collaboration Vc3 Platform Firmware 107 Qcm6490 Firmware 105 Sc8380xp Firmware 103 Wcd9395 Firmware 103 Qcm5430 Firmware 102 Fastconnect 6200 Firmware 100 Qca6595au Firmware 100 Qca6698aq Firmware 99 Qca6797aq Firmware 96 Wcd9378 Firmware 95 Qca6391 Firmware 95 Wcn7861 Firmware 93 Qca6696 Firmware 92 Wcn6755 Firmware 90 Qca6574au Firmware 88 Wcn7881 Firmware 87 Wcn7860 Firmware 86 Sa9000p Firmware 84 Qam8255p Firmware 83 Qca6595 Firmware 83 Sa8255p Firmware 83 Wcd9390 Firmware 82

Exploited only (KEV) →

CVE-2026-25281 High · 7.4 CWE-770 Sep 17, 2026

Allocation of Resources Without Limits or Throttling in OOBM

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.

CVE-2026-25280 High · 7.8 CWE-787 Sep 17, 2026

Out-of-bounds Write in DSP Service

Memory corruption when processing escape handling flow with insufficient user buffer sizes.

CVE-2026-25278 High · 7.0 CWE-367 Sep 17, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

CVE-2026-25275 High · 7.5 CWE-126 Sep 17, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

CVE-2026-25261 High · 7.8 CWE-822 Sep 17, 2026

Untrusted Pointer Dereference in Camera

Memory corruption while processing rear sensor IOCTL calls.

CVE-2026-24081 High · 7.4 CWE-126 Sep 17, 2026

Buffer Over-read in BT Controller

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.

CVE-2026-24075 High · 7.0 CWE-126 Sep 17, 2026

Buffer Over-read in Qualcomm IPC

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

CVE-2026-24074 High · 7.8 CWE-787 Sep 17, 2026

Out-of-bounds Write in Video

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.

CVE-2026-24073 High · 7.8 CWE-787 Sep 17, 2026

Out-of-bounds Write in Video

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

CVE-2025-59607 High · 7.8 CWE-822 Sep 17, 2026

Untrusted Pointer Dereference in Windows Compute

Memory Corruption when copying large input data exceeds normal allocation limits.

CVE-2026-25292 High · 7.6 CWE-1286 Aug 4, 2026

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

CVE-2026-25289 Critical · 9.6 CWE-121 Aug 4, 2026

Stack-based Buffer Overflow in WLAN Firmware

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

CVE-2026-25288 High · 7.4 CWE-126 Aug 4, 2026

Buffer Over-read in WLAN Firmware

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.

CVE-2026-24084 High · 7.5 CWE-1294 Aug 4, 2026

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

CVE-2026-24083 High · 7.8 CWE-822 Aug 4, 2026

Untrusted Pointer Dereference in Automotive Security

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

CVE-2026-24080 High · 7.8 CWE-120 Aug 4, 2026

Buffer Copy Without Checking Size of Input in Biometrics

Memory Corruption when handling malformed request parameters in the fingerprint TA.

CVE-2026-24079 High · 8.1 CWE-306 Aug 4, 2026

Missing Authentication for Critical Function in Data Modem

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

CVE-2026-24078 Medium · 6.5 CWE-359 Aug 4, 2026

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

CVE-2026-24077 Medium · 6.5 CWE-191 Aug 4, 2026

Integer Underflow (Wrap or Wraparound) in WLAN Host

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

CVE-2026-24076 Medium · 6.7 CWE-120 Aug 4, 2026

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory Corruption when processing registry values with incorrect types using a direct query method.

CVE-2026-21366 High · 7.8 CWE-190 Aug 4, 2026

Integer Overflow or Wraparound in Data Network Stack & Connectivity

Memory corruption while processing a packet with a size close to the maximum allowed value.

CVE-2026-25271 High · 7.0 CWE-367 Jul 6, 2026

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.

CVE-2026-25268 High · 8.8 CWE-121 Jul 6, 2026

Stack-based Buffer Overflow in WLAN Host

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

CVE-2026-21384 Medium · 5.3 CWE-787 Jul 6, 2026

Out-of-bounds Write in Camera Driver

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

CVE-2026-21383 High · 7.1 CWE-323 Jul 6, 2026

Reusing a Nonce, Key Pair in Encryption in HLOS

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.