Mdm9250 Firmware (Qualcomm) - vulnerabilities (CVEs)

205 CVEs, 1 in the last 30 days, 1 known versions, newest CVE from 2026-10-06. Vendor: Qualcomm.

CVEs of Mdm9250 Firmware

CVE-2026-57554 - CVSS 7.8 (high), 2026-10-06: Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-24082 - CVSS 7.8 (high), 2026-05-04: Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
CVE-2025-47404 - CVSS 7.8 (high), 2026-05-04: Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
CVE-2026-21385 - CVSS 7.8 (high), 2026-03-02: Memory corruption while using alignments for memory allocation.
CVE-2025-47386 - CVSS 7.8 (high), 2026-03-02: Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
CVE-2025-47383 - CVSS 7.2 (high), 2026-03-02: Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
CVE-2025-47379 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
CVE-2025-47376 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
CVE-2025-47375 - CVSS 7.8 (high), 2026-03-02: Memory corruption while handling different IOCTL calls from the user-space simultaneously.
CVE-2025-47320 - CVSS 7.8 (high), 2025-12-18: Memory corruption while processing MFC channel configuration during music playback.
CVE-2025-27053 - CVSS 7.8 (high), 2025-10-09: Memory corruption during PlayReady APP usecase while processing TA commands.
CVE-2025-21482 - CVSS 7.1 (high), 2025-09-24: Cryptographic issue while performing RSA PKCS padding decoding.
CVE-2025-21429 - CVSS 7.5 (high), 2025-04-07: Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
CVE-2025-21428 - CVSS 7.5 (high), 2025-04-07: Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
CVE-2024-38423 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing GPU page table switch.
CVE-2024-38422 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing voice packet with arbitrary data received from ADSP.
CVE-2024-33060 - CVSS 8.4 (high), 2024-09-02: Memory corruption when two threads try to map and unmap a single node simultaneously.
CVE-2024-33051 - CVSS 7.5 (high), 2024-09-02: Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
CVE-2024-23353 - CVSS 7.5 (high), 2024-08-05: Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
CVE-2023-43551 - CVSS 9.1 (critical), 2024-06-03: Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode…
CVE-2024-21471 - CVSS 8.4 (high), 2024-05-06: Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
CVE-2024-21468 - CVSS 8.4 (high), 2024-04-01: Memory corruption when there is failed unmap operation in GPU.
CVE-2023-33066 - CVSS 8.4 (high), 2024-03-04: Memory corruption in Audio while processing RT proxy port register driver.
CVE-2023-28578 - CVSS 9.3 (critical), 2024-03-04: Memory corruption in Core Services while executing the command for removing a single event listener.
CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
CVE-2023-33120 - CVSS 7.8 (high), 2024-01-02: Memory corruption in Audio when memory map command is executed consecutively in ADSP.
CVE-2023-33033 - CVSS 8.4 (high), 2024-01-02: Memory corruption in Audio during playback with speaker protection.
CVE-2023-33030 - CVSS 9.3 (critical), 2024-01-02: Memory corruption in HLOS while running playready use-case.
CVE-2023-33107 - CVSS 8.4 (high), 2023-12-05: Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
CVE-2023-33080 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
CVE-2023-33017 - CVSS 7.8 (high), 2023-12-05: Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
CVE-2023-33018 - CVSS 7.8 (high), 2023-12-05: Memory corruption while using the UIM diag command to get the operators name.
CVE-2023-28586 - CVSS 6.5 (medium), 2023-12-05: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
CVE-2023-28551 - CVSS 7.8 (high), 2023-12-05: Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
CVE-2023-28550 - CVSS 7.8 (high), 2023-12-05: Memory corruption in MPP performance while accessing DSM watermark using external memory address.
CVE-2023-33059 - CVSS 7.8 (high), 2023-11-07: Memory corruption in Audio while processing the VOC packet data from ADSP.
CVE-2023-22388 - CVSS 9.8 (critical), 2023-11-07: Memory Corruption in Multi-mode Call Processor while processing bit mask API.
CVE-2023-24849 - CVSS 8.2 (high), 2023-10-03: Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
CVE-2023-24848 - CVSS 8.2 (high), 2023-10-03: Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
CVE-2023-24847 - CVSS 7.5 (high), 2023-10-03: Transient DOS in Modem while allocating DSM items.
CVE-2023-22385 - CVSS 9.8 (critical), 2023-10-03: Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
CVE-2023-33020 - CVSS 7.5 (high), 2023-09-05: Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
CVE-2023-33019 - CVSS 7.5 (high), 2023-09-05: Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
CVE-2023-28565 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVE-2023-28564 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
CVE-2023-28559 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
CVE-2023-21625 - CVSS 8.2 (high), 2023-08-08: Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
CVE-2022-40510 - CVSS 9.8 (critical), 2023-08-08: Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
CVE-2023-28542 - CVSS 7.8 (high), 2023-07-04: Memory Corruption in WLAN HOST while fetching TX status information.
CVE-2023-28541 - CVSS 7.8 (high), 2023-07-04: Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
CVE-2023-21629 - CVSS 6.8 (medium), 2023-07-04: Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
CVE-2023-21628 - CVSS 8.4 (high), 2023-06-06: Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
CVE-2022-40521 - CVSS 7.5 (high), 2023-06-06: Transient DOS due to improper authorization in Modem
CVE-2022-40507 - CVSS 8.4 (high), 2023-06-06: Memory corruption due to double free in Core while mapping HLOS address to the list.
CVE-2022-33264 - CVSS 7.9 (high), 2023-06-06: Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
CVE-2022-22076 - CVSS 7.1 (high), 2023-06-06: information disclosure due to cryptographic issue in Core during RPMB read request.
CVE-2023-21665 - CVSS 8.4 (high), 2023-05-02: Memory corruption in Graphics while importing a file.
CVE-2023-21666 - CVSS 8.4 (high), 2023-05-02: Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
CVE-2022-40532 - CVSS 8.4 (high), 2023-04-13: Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
CVE-2022-33302 - CVSS 7.8 (high), 2023-04-13: Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
CVE-2022-40503 - CVSS 8.2 (high), 2023-04-13: Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
CVE-2022-33289 - CVSS 6.8 (medium), 2023-04-13: Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
CVE-2022-40531 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
CVE-2022-40515 - CVSS 9.8 (critical), 2023-03-10: Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
CVE-2022-40537 - CVSS 9.8 (critical), 2023-03-10: Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
CVE-2022-25694 - CVSS 8.4 (high), 2023-03-10: Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
CVE-2022-25655 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
CVE-2022-33213 - CVSS 8.8 (high), 2023-03-10: Memory corruption in modem due to buffer overflow while processing a PPP packet
CVE-2022-22075 - CVSS 6.2 (medium), 2023-03-10: Information Disclosure in Graphics during GPU context switch.
CVE-2022-25705 - CVSS 7.8 (high), 2023-03-10: Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
CVE-2022-40512 - CVSS 7.5 (high), 2023-02-12: Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
CVE-2022-33233 - CVSS 7.8 (high), 2023-02-12: Memory corruption due to configuration weakness in modem wile sending command to write protected files.
CVE-2022-33280 - CVSS 8.8 (high), 2023-02-12: Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
CVE-2022-33248 - CVSS 7.8 (high), 2023-02-12: Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
CVE-2022-33286 - CVSS 7.5 (high), 2023-01-09: Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
CVE-2022-33285 - CVSS 7.5 (high), 2023-01-09: Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
CVE-2022-33299 - CVSS 7.5 (high), 2023-01-09: Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
CVE-2022-33266 - CVSS 7.8 (high), 2023-01-09: Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
CVE-2022-33290 - CVSS 7.5 (high), 2023-01-09: Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed.
CVE-2022-25717 - CVSS 7.8 (high), 2023-01-09: Memory corruption in display due to double free while allocating frame buffer memory
CVE-2022-22079 - CVSS 4.6 (medium), 2023-01-09: Denial of service while processing fastboot flash command on mmc due to buffer over read
CVE-2022-33268 - CVSS 8.2 (high), 2022-12-13: Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-33238 - CVSS 7.5 (high), 2022-12-13: Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-25695 - CVSS 8.4 (high), 2022-12-13: Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute,…
CVE-2022-25682 - CVSS 8.4 (high), 2022-12-13: Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-25743 - CVSS 8.4 (high), 2022-11-15: Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-33239 - CVSS 7.5 (high), 2022-11-15: Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute,…
CVE-2022-25724 - CVSS 8.4 (high), 2022-11-15: Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25710 - CVSS 7.5 (high), 2022-11-15: Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2022-25718 - CVSS 9.8 (critical), 2022-10-19: Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…
CVE-2022-25749 - CVSS 7.5 (high), 2022-10-19: Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25687 - CVSS 9.8 (critical), 2022-10-19: memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2022-25748 - CVSS 9.8 (critical), 2022-10-19: Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-25720 - CVSS 9.8 (critical), 2022-10-19: Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2022-22058 - CVSS 8.4 (high), 2022-09-26: Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25690 - CVSS 7.5 (high), 2022-09-16: Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute,…
CVE-2022-25688 - CVSS 9.8 (critical), 2022-09-16: Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2022-25669 - CVSS 7.5 (high), 2022-09-16: Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2022-22105 - CVSS 9.8 (critical), 2022-09-16: Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile,…