X2000086 Firmware
Monthly
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.
Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.
Memory corruption in the image-encoding completion event handler of multiple Qualcomm chipset firmware images allows an attacker who already holds local, low-privilege code execution on the device to trigger a buffer overflow and achieve high integrity and confidentiality impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The affected platforms span FastConnect 6700/6900/7800 connectivity chips, QCC2072, QCM/QCS 5430 and 6490, SC8380XP, the VC3 video collaboration platform, WCD/WSA audio codecs, and Snapdragon 8cx Gen 3 / 7c Gen 3 compute platforms. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is negligible at 0.09% (0th percentile), consistent with a local-only precondition. Vendor-released fixes are documented in Qualcomm's October 2025 security bulletin and are distributed through device OEMs.
An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.
Memory corruption in Qualcomm FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378c/9380/9385 and WSA8840/8845/8845h firmware allows a local attacker who already holds low privileges (PR:L, AV:L) to make the firmware dereference untrusted pointers by issuing crafted 'escape commands' from userspace, achieving high confidentiality and integrity impact within the firmware context (CVSS 7.8). There is no network vector and no user interaction, so this is best characterized as a post-compromise privilege-escalation primitive on an already-breached device rather than a directly remote or unauthenticated attack. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, percentile 0%), but Qualcomm published a fix in its October 2025 product security bulletin.
Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.
Local attackers with low privileges can trigger a transient denial-of-service (DoS) in Qualcomm FastConnect firmware (and other listed Qualcomm chipsets) by invoking a crafted IOCTL call for image encoding, leading to a temporary device reset. The flaw is not remotely exploitable and requires existing code execution on the device; it affects availability only, with no confidentiality or integrity impact, and recovery is automatic. With an EPSS score of 0.08% and no public exploit identified, this is a low-priority issue.
Memory corruption in Qualcomm's camera platform driver firmware lets a locally-resident attacker escalate privileges from an unprivileged process to the firmware/kernel layer by supplying malformed arguments to camera driver IOCTL calls, triggering an untrusted pointer dereference (CWE-822). It is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation requires the attacker to already run code on the device as a low-privilege process that can open and issue IOCTLs against the camera device node; there is no remote attack surface and no user interaction, making this a privilege-escalation primitive rather than an initial-access vector. No public exploit identified at time of analysis, it is not listed on CISA KEV, and EPSS is 0.09% (0th percentile), reflecting the mandatory local foothold.
Information disclosure in the Qualcomm video driver lets a local, low-privileged user read out-of-bounds memory by causing the driver to process crafted batch command execution, leaking potentially sensitive data from adjacent memory with only a minor availability impact. Affected firmware spans a broad set of Qualcomm silicon and companion parts, including FastConnect 6900/7800, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 and WSA8840/WSA8845/WSA8845H chips, as well as several X2000xxx and XG101xxx platforms. The issue requires the attacker to already hold local code execution at low privilege (AV:L/PR:L), needs no user interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.10% (1st percentile), so this is a moderate-severity, low-priority issue in practice.
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.
Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.
Memory corruption in the image-encoding completion event handler of multiple Qualcomm chipset firmware images allows an attacker who already holds local, low-privilege code execution on the device to trigger a buffer overflow and achieve high integrity and confidentiality impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The affected platforms span FastConnect 6700/6900/7800 connectivity chips, QCC2072, QCM/QCS 5430 and 6490, SC8380XP, the VC3 video collaboration platform, WCD/WSA audio codecs, and Snapdragon 8cx Gen 3 / 7c Gen 3 compute platforms. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is negligible at 0.09% (0th percentile), consistent with a local-only precondition. Vendor-released fixes are documented in Qualcomm's October 2025 security bulletin and are distributed through device OEMs.
An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.
Memory corruption in Qualcomm FastConnect 6900/7800, QCC2072, SC8380XP, WCD9378c/9380/9385 and WSA8840/8845/8845h firmware allows a local attacker who already holds low privileges (PR:L, AV:L) to make the firmware dereference untrusted pointers by issuing crafted 'escape commands' from userspace, achieving high confidentiality and integrity impact within the firmware context (CVSS 7.8). There is no network vector and no user interaction, so this is best characterized as a post-compromise privilege-escalation primitive on an already-breached device rather than a directly remote or unauthenticated attack. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, percentile 0%), but Qualcomm published a fix in its October 2025 product security bulletin.
Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.
Local attackers with low privileges can trigger a transient denial-of-service (DoS) in Qualcomm FastConnect firmware (and other listed Qualcomm chipsets) by invoking a crafted IOCTL call for image encoding, leading to a temporary device reset. The flaw is not remotely exploitable and requires existing code execution on the device; it affects availability only, with no confidentiality or integrity impact, and recovery is automatic. With an EPSS score of 0.08% and no public exploit identified, this is a low-priority issue.
Memory corruption in Qualcomm's camera platform driver firmware lets a locally-resident attacker escalate privileges from an unprivileged process to the firmware/kernel layer by supplying malformed arguments to camera driver IOCTL calls, triggering an untrusted pointer dereference (CWE-822). It is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation requires the attacker to already run code on the device as a low-privilege process that can open and issue IOCTLs against the camera device node; there is no remote attack surface and no user interaction, making this a privilege-escalation primitive rather than an initial-access vector. No public exploit identified at time of analysis, it is not listed on CISA KEV, and EPSS is 0.09% (0th percentile), reflecting the mandatory local foothold.
Information disclosure in the Qualcomm video driver lets a local, low-privileged user read out-of-bounds memory by causing the driver to process crafted batch command execution, leaking potentially sensitive data from adjacent memory with only a minor availability impact. Affected firmware spans a broad set of Qualcomm silicon and companion parts, including FastConnect 6900/7800, QCC2072, SC8380XP, and the WCD9378C/WCD9380/WCD9385 and WSA8840/WSA8845/WSA8845H chips, as well as several X2000xxx and XG101xxx platforms. The issue requires the attacker to already hold local code execution at low privilege (AV:L/PR:L), needs no user interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.10% (1st percentile), so this is a moderate-severity, low-priority issue in practice.