Wsa8845h Firmware
Monthly
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memory allocation, enabling local privilege escalation to kernel level. KEV-listed and patched, this vulnerability affects Qualcomm-based mobile devices and embedded systems, potentially impacting billions of Android devices globally.
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Memory corruption in DSP Services during a remote call from HLOS to DSP. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Memory Corruption when adding user-supplied data without checking available buffer space. [CVSS 7.8 HIGH]
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when accessing trusted execution environment without proper privilege check. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - contains a vulnerability that allows attackers to cryptographic issue when a VoWiFi call is triggered from UE (CVSS 7.2).
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. [CVSS 7.8 HIGH]
Memory corruption while handling different IOCTL calls from the user-space simultaneously. [CVSS 7.8 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. [CVSS 7.8 HIGH]
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. [CVSS 7.8 HIGH]
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. [CVSS 7.1 HIGH]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption occurs when a secure application is launched on a device with insufficient memory. [CVSS 7.8 HIGH]
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. [CVSS 7.8 HIGH]
Memory corruption while passing pages to DSP with an unaligned starting address. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. [CVSS 5.5 MEDIUM]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Memory corruption while processing identity credential operations in the trusted application. [CVSS 7.8 HIGH]
Memory corruption while processing a secure logging command in the trusted application. [CVSS 7.8 HIGH]
Cryptographic issue may occur while encrypting license data. [CVSS 8.4 HIGH]
Memory corruption while handling sensor utility operations. [CVSS 6.7 MEDIUM]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption while accessing a synchronization object during concurrent operations. [CVSS 6.7 MEDIUM]
Memory corruption while performing sensor register read operations. [CVSS 6.7 MEDIUM]
Memory corruption while parsing clock configuration data for a specific hardware type. [CVSS 6.7 MEDIUM]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Memory corruption while handling buffer mapping operations in the cryptographic driver. [CVSS 6.6 MEDIUM]
Memory corruption while processing a config call from userspace. [CVSS 6.7 MEDIUM]
Information disclosure while processing a firmware event. [CVSS 6.1 MEDIUM]
Transient DOS while parsing video packets received from the video firmware. [CVSS 5.5 MEDIUM]
Memory corruption in Qualcomm firmware's Generic Packet Router (GPR) lets a locally present, low-privileged attacker escalate to root-level code execution on a broad range of Snapdragon, FastConnect, QAM/QCA/QCN and related chipsets. Per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw requires an existing foothold as an unprivileged local process - a malicious or compromised app, for example - which then routes an oversized data packet through the GPR path that bridges user and root/kernel contexts, triggering a CWE-190 integer overflow and full compromise of confidentiality, integrity and availability. It is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis; Qualcomm published the issue in its December 2025 security bulletin for OEM distribution.
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing encryption and decryption commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.
Local privilege escalation in Qualcomm's DSP service buffer-allocation path affects numerous FastConnect, QMP1000, SM-series, and Snapdragon mobile/wearable platform firmware components. The flaw is a use-after-free (CWE-416) that allows an authenticated local attacker with low privileges-such as a malicious app or compromised unprivileged process able to reach the DSP IPC interface-to corrupt memory and potentially execute code in the DSP context, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is 0.09%, so priority is bounded by the local-only attack vector despite the 7.8 CVSS score.
Memory corruption in Qualcomm chipset firmware (FastConnect, Snapdragon, and associated audio/connectivity chips) allows local attackers with low privileges to execute code or escalate privileges by submitting crafted user buffers to the vulnerable buffer-handling code. The integer overflow (CWE-190) requires on-device execution and an active targeted subsystem; no public exploit code has been identified as of analysis, and the EPSS score is low at 0.09%. Affected firmware includes FastConnect 6200/6700/6900/7800, SG6150(P), SM8750(P), SM8850(P), and WCD/WCN/WSA series.
Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.
Memory corruption in the image-encoding completion event handler of multiple Qualcomm chipset firmware images allows an attacker who already holds local, low-privilege code execution on the device to trigger a buffer overflow and achieve high integrity and confidentiality impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The affected platforms span FastConnect 6700/6900/7800 connectivity chips, QCC2072, QCM/QCS 5430 and 6490, SC8380XP, the VC3 video collaboration platform, WCD/WSA audio codecs, and Snapdragon 8cx Gen 3 / 7c Gen 3 compute platforms. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is negligible at 0.09% (0th percentile), consistent with a local-only precondition. Vendor-released fixes are documented in Qualcomm's October 2025 security bulletin and are distributed through device OEMs.
An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.
Memory corruption in Qualcomm FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378c/9380/9385 and WSA8840/8845/8845h firmware allows a local attacker who already holds low privileges (PR:L, AV:L) to make the firmware dereference untrusted pointers by issuing crafted 'escape commands' from userspace, achieving high confidentiality and integrity impact within the firmware context (CVSS 7.8). There is no network vector and no user interaction, so this is best characterized as a post-compromise privilege-escalation primitive on an already-breached device rather than a directly remote or unauthenticated attack. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, percentile 0%), but Qualcomm published a fix in its October 2025 product security bulletin.
Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.
Local attackers with low privileges can trigger a transient denial-of-service (DoS) in Qualcomm FastConnect firmware (and other listed Qualcomm chipsets) by invoking a crafted IOCTL call for image encoding, leading to a temporary device reset. The flaw is not remotely exploitable and requires existing code execution on the device; it affects availability only, with no confidentiality or integrity impact, and recovery is automatic. With an EPSS score of 0.08% and no public exploit identified, this is a low-priority issue.
Memory corruption in Qualcomm's camera platform driver firmware lets a locally-resident attacker escalate privileges from an unprivileged process to the firmware/kernel layer by supplying malformed arguments to camera driver IOCTL calls, triggering an untrusted pointer dereference (CWE-822). It is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation requires the attacker to already run code on the device as a low-privilege process that can open and issue IOCTLs against the camera device node; there is no remote attack surface and no user interaction, making this a privilege-escalation primitive rather than an initial-access vector. No public exploit identified at time of analysis, it is not listed on CISA KEV, and EPSS is 0.09% (0th percentile), reflecting the mandatory local foothold.
Information disclosure in the Qualcomm video driver lets a local, low-privileged user read out-of-bounds memory by causing the driver to process crafted batch command execution, leaking potentially sensitive data from adjacent memory with only a minor availability impact. Affected firmware spans a broad set of Qualcomm silicon and companion parts, including FastConnect 6900/7800, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 and WSA8840/WSA8845/WSA8845H chips, as well as several X2000xxx and XG101xxx platforms. The issue requires the attacker to already hold local code execution at low privilege (AV:L/PR:L), needs no user interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.10% (1st percentile), so this is a moderate-severity, low-priority issue in practice.
Memory corruption while handling invalid inputs in application info setup. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing power control requests with invalid antenna or stream values. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while encoding the image data. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while handling command data during power control processing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Transient DOS while parsing the EPTM test control message to get the test pattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption due to global buffer overflow when a test command uses an invalid payload type. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption due to double free when multiple threads race to set the timestamp store. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure when Video engine escape input data is less than expected minimum size. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while selecting the PLMN from SOR failed list. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cryptographic issue while performing RSA PKCS padding decoding. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing private key encryption in trusted application. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing simultaneous requests via escape path. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while creating NDP instance. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while processing DDI command calls. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing an IOCTL command with an arbitrary address. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing DDI call with invalid buffer. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing an ANQP message. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Transient DOS while processing a frame with malformed shared-key descriptor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while handling client exceptions, allowing unauthorized channel access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing CCCH data when NW sends data with invalid length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure while processing the hash segment in an MBN file. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while reading data from an image using specified offset and size parameters. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memory allocation, enabling local privilege escalation to kernel level. KEV-listed and patched, this vulnerability affects Qualcomm-based mobile devices and embedded systems, potentially impacting billions of Android devices globally.
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Memory corruption in DSP Services during a remote call from HLOS to DSP. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Memory Corruption when adding user-supplied data without checking available buffer space. [CVSS 7.8 HIGH]
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when accessing trusted execution environment without proper privilege check. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - contains a vulnerability that allows attackers to cryptographic issue when a VoWiFi call is triggered from UE (CVSS 7.2).
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. [CVSS 7.8 HIGH]
Memory corruption while handling different IOCTL calls from the user-space simultaneously. [CVSS 7.8 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. [CVSS 7.8 HIGH]
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. [CVSS 7.8 HIGH]
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. [CVSS 7.1 HIGH]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption occurs when a secure application is launched on a device with insufficient memory. [CVSS 7.8 HIGH]
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. [CVSS 7.8 HIGH]
Memory corruption while passing pages to DSP with an unaligned starting address. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. [CVSS 5.5 MEDIUM]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Memory corruption while processing identity credential operations in the trusted application. [CVSS 7.8 HIGH]
Memory corruption while processing a secure logging command in the trusted application. [CVSS 7.8 HIGH]
Cryptographic issue may occur while encrypting license data. [CVSS 8.4 HIGH]
Memory corruption while handling sensor utility operations. [CVSS 6.7 MEDIUM]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption while accessing a synchronization object during concurrent operations. [CVSS 6.7 MEDIUM]
Memory corruption while performing sensor register read operations. [CVSS 6.7 MEDIUM]
Memory corruption while parsing clock configuration data for a specific hardware type. [CVSS 6.7 MEDIUM]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Memory corruption while handling buffer mapping operations in the cryptographic driver. [CVSS 6.6 MEDIUM]
Memory corruption while processing a config call from userspace. [CVSS 6.7 MEDIUM]
Information disclosure while processing a firmware event. [CVSS 6.1 MEDIUM]
Transient DOS while parsing video packets received from the video firmware. [CVSS 5.5 MEDIUM]
Memory corruption in Qualcomm firmware's Generic Packet Router (GPR) lets a locally present, low-privileged attacker escalate to root-level code execution on a broad range of Snapdragon, FastConnect, QAM/QCA/QCN and related chipsets. Per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw requires an existing foothold as an unprivileged local process - a malicious or compromised app, for example - which then routes an oversized data packet through the GPR path that bridges user and root/kernel contexts, triggering a CWE-190 integer overflow and full compromise of confidentiality, integrity and availability. It is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis; Qualcomm published the issue in its December 2025 security bulletin for OEM distribution.
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing encryption and decryption commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.
Local privilege escalation in Qualcomm's DSP service buffer-allocation path affects numerous FastConnect, QMP1000, SM-series, and Snapdragon mobile/wearable platform firmware components. The flaw is a use-after-free (CWE-416) that allows an authenticated local attacker with low privileges-such as a malicious app or compromised unprivileged process able to reach the DSP IPC interface-to corrupt memory and potentially execute code in the DSP context, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is 0.09%, so priority is bounded by the local-only attack vector despite the 7.8 CVSS score.
Memory corruption in Qualcomm chipset firmware (FastConnect, Snapdragon, and associated audio/connectivity chips) allows local attackers with low privileges to execute code or escalate privileges by submitting crafted user buffers to the vulnerable buffer-handling code. The integer overflow (CWE-190) requires on-device execution and an active targeted subsystem; no public exploit code has been identified as of analysis, and the EPSS score is low at 0.09%. Affected firmware includes FastConnect 6200/6700/6900/7800, SG6150(P), SM8750(P), SM8850(P), and WCD/WCN/WSA series.
Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.
Memory corruption in the image-encoding completion event handler of multiple Qualcomm chipset firmware images allows an attacker who already holds local, low-privilege code execution on the device to trigger a buffer overflow and achieve high integrity and confidentiality impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The affected platforms span FastConnect 6700/6900/7800 connectivity chips, QCC2072, QCM/QCS 5430 and 6490, SC8380XP, the VC3 video collaboration platform, WCD/WSA audio codecs, and Snapdragon 8cx Gen 3 / 7c Gen 3 compute platforms. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is negligible at 0.09% (0th percentile), consistent with a local-only precondition. Vendor-released fixes are documented in Qualcomm's October 2025 security bulletin and are distributed through device OEMs.
An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.
Memory corruption in Qualcomm FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378c/9380/9385 and WSA8840/8845/8845h firmware allows a local attacker who already holds low privileges (PR:L, AV:L) to make the firmware dereference untrusted pointers by issuing crafted 'escape commands' from userspace, achieving high confidentiality and integrity impact within the firmware context (CVSS 7.8). There is no network vector and no user interaction, so this is best characterized as a post-compromise privilege-escalation primitive on an already-breached device rather than a directly remote or unauthenticated attack. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, percentile 0%), but Qualcomm published a fix in its October 2025 product security bulletin.
Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.
Local attackers with low privileges can trigger a transient denial-of-service (DoS) in Qualcomm FastConnect firmware (and other listed Qualcomm chipsets) by invoking a crafted IOCTL call for image encoding, leading to a temporary device reset. The flaw is not remotely exploitable and requires existing code execution on the device; it affects availability only, with no confidentiality or integrity impact, and recovery is automatic. With an EPSS score of 0.08% and no public exploit identified, this is a low-priority issue.
Memory corruption in Qualcomm's camera platform driver firmware lets a locally-resident attacker escalate privileges from an unprivileged process to the firmware/kernel layer by supplying malformed arguments to camera driver IOCTL calls, triggering an untrusted pointer dereference (CWE-822). It is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation requires the attacker to already run code on the device as a low-privilege process that can open and issue IOCTLs against the camera device node; there is no remote attack surface and no user interaction, making this a privilege-escalation primitive rather than an initial-access vector. No public exploit identified at time of analysis, it is not listed on CISA KEV, and EPSS is 0.09% (0th percentile), reflecting the mandatory local foothold.
Information disclosure in the Qualcomm video driver lets a local, low-privileged user read out-of-bounds memory by causing the driver to process crafted batch command execution, leaking potentially sensitive data from adjacent memory with only a minor availability impact. Affected firmware spans a broad set of Qualcomm silicon and companion parts, including FastConnect 6900/7800, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 and WSA8840/WSA8845/WSA8845H chips, as well as several X2000xxx and XG101xxx platforms. The issue requires the attacker to already hold local code execution at low privilege (AV:L/PR:L), needs no user interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.10% (1st percentile), so this is a moderate-severity, low-priority issue in practice.
Memory corruption while handling invalid inputs in application info setup. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing power control requests with invalid antenna or stream values. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while encoding the image data. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while handling command data during power control processing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Transient DOS while parsing the EPTM test control message to get the test pattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption due to global buffer overflow when a test command uses an invalid payload type. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption due to double free when multiple threads race to set the timestamp store. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure when Video engine escape input data is less than expected minimum size. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while selecting the PLMN from SOR failed list. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cryptographic issue while performing RSA PKCS padding decoding. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing private key encryption in trusted application. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing simultaneous requests via escape path. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while creating NDP instance. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while processing DDI command calls. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing an IOCTL command with an arbitrary address. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing DDI call with invalid buffer. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing an ANQP message. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Transient DOS while processing a frame with malformed shared-key descriptor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory corruption while handling client exceptions, allowing unauthorized channel access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Transient DOS while processing CCCH data when NW sends data with invalid length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure while processing the hash segment in an MBN file. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while reading data from an image using specified offset and size parameters. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.