Qca0000 Firmware (Qualcomm) - vulnerabilities (CVEs)

137 CVEs, 6 in the last 30 days, 1 known versions, newest CVE from 2026-10-06. Vendor: Qualcomm.

CVEs of Qca0000 Firmware

• CVE-2026-57559 - CVSS 7.8 (high), 2026-10-06: Memory corruption while processing service requests.
• CVE-2026-57555 - CVSS 7.8 (high), 2026-10-06: Memory Corruption when executing system service routines due to improper handling of user input buffers.
• CVE-2026-25302 - CVSS 7.1 (high), 2026-10-06: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted…
• CVE-2026-25274 - CVSS 6.7 (medium), 2026-10-06: Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
• CVE-2026-25267 - CVSS 7.8 (high), 2026-10-06: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
• CVE-2026-25263 - CVSS 6.6 (medium), 2026-10-06: Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
• CVE-2026-25280 - CVSS 7.8 (high), 2026-09-17: Memory corruption when processing escape handling flow with insufficient user buffer sizes.
• CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-25261 - CVSS 7.8 (high), 2026-09-17: Memory corruption while processing rear sensor IOCTL calls.
• CVE-2026-24081 - CVSS 7.4 (high), 2026-09-17: Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
• CVE-2026-24075 - CVSS 7.8 (high), 2026-09-17: Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
• CVE-2026-24074 - CVSS 7.8 (high), 2026-09-17: Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
• CVE-2026-24073 - CVSS 7.8 (high), 2026-09-17: Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
• CVE-2026-25289 - CVSS 9.6 (critical), 2026-08-04: Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
• CVE-2026-24076 - CVSS 6.7 (medium), 2026-08-04: Memory Corruption when processing registry values with incorrect types using a direct query method.
• CVE-2026-25271 - CVSS 7.8 (high), 2026-07-06: Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.
• CVE-2026-25268 - CVSS 8.8 (high), 2026-07-06: Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2026-21379 - CVSS 7.8 (high), 2026-07-06: Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
• CVE-2026-25259 - CVSS 7.8 (high), 2026-06-01: Memory corruption while processing multiple IOCTL command for escape operations.
• CVE-2026-25258 - CVSS 7.8 (high), 2026-06-01: Memory corruption while processing IOCTL calls for escape operations.
• CVE-2025-59609 - CVSS 5.5 (medium), 2026-06-01: Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
• CVE-2025-59613 - CVSS 6.7 (medium), 2026-06-01: Memory Corruption when output buffer size is smaller than input buffer size during data copying operation.
• CVE-2025-59612 - CVSS 6.7 (medium), 2026-06-01: Memory corruption in windows drivers while sending incorrect trusted application request
• CVE-2025-59611 - CVSS 6.7 (medium), 2026-06-01: Memory corruption in diagnostic services due to absence of input validation
• CVE-2025-59614 - CVSS 6.7 (medium), 2026-06-01: Memory Corruption when sending random number generator command with insufficient output buffer size.
• CVE-2025-59604 - CVSS 7.8 (high), 2026-06-01: Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
• CVE-2025-47408 - CVSS 7.8 (high), 2026-05-04: Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
• CVE-2025-47401 - CVSS 7.5 (high), 2026-05-04: Transient DOS when processing target power rate tables during channel configuration.
• CVE-2025-47406 - CVSS 6.1 (medium), 2026-05-04: Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
• CVE-2025-47405 - CVSS 7.8 (high), 2026-05-04: Memory corruption when processing camera sensor input/output control codes with invalid output buffers.
• CVE-2025-47403 - CVSS 7.5 (high), 2026-05-04: Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
• CVE-2026-21382 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when handling power management requests with improperly sized input/output buffers.
• CVE-2026-21376 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
• CVE-2026-21375 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
• CVE-2026-21380 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.
• CVE-2026-21374 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
• CVE-2026-21378 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
• CVE-2026-21373 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
• CVE-2026-21371 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when retrieving output buffer with insufficient size validation.
• CVE-2025-47390 - CVSS 7.8 (high), 2026-04-06: Memory corruption while preprocessing IOCTL request in JPEG driver.
• CVE-2025-59603 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when processing invalid user address with nonstandard buffer address.
• CVE-2025-47373 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when accessing buffers with invalid length during TA invocation.
• CVE-2025-47356 - CVSS 7.8 (high), 2026-01-07: Memory Corruption when multiple threads concurrently access and modify shared resources.
• CVE-2025-47343 - CVSS 7.8 (high), 2026-01-07: Memory corruption while processing a video session to set video parameters.
• CVE-2025-47331 - CVSS 6.1 (medium), 2026-01-07: Information disclosure while processing a firmware event.
• CVE-2025-47350 - CVSS 7.8 (high), 2025-12-18: Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.
• CVE-2025-27064 - CVSS 6.1 (medium), 2025-11-04: Information disclosure while registering commands from clients with diag through diagHal.
• CVE-2025-47328 - CVSS 7.5 (high), 2025-09-24: Transient DOS while processing power control requests with invalid antenna or stream values.
• CVE-2025-47326 - CVSS 7.5 (high), 2025-09-24: Transient DOS while handling command data during power control processing.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-27065 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing a frame with malformed shared-key descriptor.
• CVE-2025-21465 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-27061 - CVSS 7.8 (high), 2025-07-08: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27042 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing video packets received from video firmware.
• CVE-2025-21446 - CVSS 7.5 (high), 2025-07-08: Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
• CVE-2025-27029 - CVSS 7.5 (high), 2025-06-03: Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2024-45556 - CVSS 6.5 (medium), 2025-04-07: Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.
• CVE-2024-43046 - CVSS 5.5 (medium), 2025-04-07: There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2024-43057 - CVSS 7.8 (high), 2025-03-03: Memory corruption while processing command in Glink linux.
• CVE-2024-49839 - CVSS 9.8 (critical), 2025-02-03: Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2024-45569 - CVSS 9.8 (critical), 2025-02-03: Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45558 - CVSS 7.5 (high), 2025-01-06: Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2024-33063 - CVSS 7.5 (high), 2024-12-02: Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
• CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-38397 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing probe response and assoc response frame.
• CVE-2024-33073 - CVSS 8.2 (high), 2024-10-07: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33057 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33050 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33048 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33016 - CVSS 6.8 (medium), 2024-09-02: memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-33026 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-21467 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon probe frame during scan entry generation in client side.
• CVE-2024-21459 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon or probe response frame in STA.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2024-21466 - CVSS 7.5 (high), 2024-07-01: Information disclosure while parsing sub-IE length during new IE generation.
• CVE-2024-21462 - CVSS 7.1 (high), 2024-07-01: Transient DOS while loading the TA ELF file.
• CVE-2024-21457 - CVSS 7.5 (high), 2024-07-01: INformation disclosure while handling Multi-link IE in beacon frame.
• CVE-2024-21458 - CVSS 7.5 (high), 2024-07-01: Information disclosure while handling SA query action frame.
• CVE-2024-23363 - CVSS 7.5 (high), 2024-06-03: Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
• CVE-2023-43537 - CVSS 7.5 (high), 2024-06-03: Information disclosure while handling T2LM Action Frame in WLAN Host.
• CVE-2024-21477 - CVSS 7.5 (high), 2024-05-06: Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
• CVE-2024-21473 - CVSS 9.8 (critical), 2024-04-01: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2023-43552 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2023-43553 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-43549 - CVSS 8.4 (high), 2024-03-04: Memory corruption while processing TPC target power table in FTM TPC.
• CVE-2023-33105 - CVSS 7.5 (high), 2024-03-04: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
• CVE-2023-43539 - CVSS 7.5 (high), 2024-03-04: Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
• CVE-2023-28578 - CVSS 9.3 (critical), 2024-03-04: Memory corruption in Core Services while executing the command for removing a single event listener.
• CVE-2023-43522 - CVSS 7.5 (high), 2024-02-06: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
• CVE-2023-43523 - CVSS 7.5 (high), 2024-02-06: Transient DOS while processing 11AZ RTT management action frame received through OTA.
• CVE-2023-33072 - CVSS 9.3 (critical), 2024-02-06: Memory corruption in Core while processing control functions.
• CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
• CVE-2023-33116 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
• CVE-2023-33109 - CVSS 7.5 (high), 2024-01-02: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
• CVE-2023-33062 - CVSS 7.5 (high), 2024-01-02: Transient DOS in WLAN Firmware while parsing a BTM request.