Qca6430 Firmware (Qualcomm) - vulnerabilities (CVEs)

590 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-06. Vendor: Qualcomm.

CVEs of Qca6430 Firmware

• CVE-2026-25274 - CVSS 6.7 (medium), 2026-10-06: Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
• CVE-2026-25267 - CVSS 7.8 (high), 2026-10-06: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
• CVE-2026-25263 - CVSS 6.6 (medium), 2026-10-06: Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
• CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-24075 - CVSS 7.8 (high), 2026-09-17: Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
• CVE-2026-24084 - CVSS 7.5 (high), 2026-08-04: Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
• CVE-2026-24077 - CVSS 6.5 (medium), 2026-08-04: Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
• CVE-2026-24076 - CVSS 6.7 (medium), 2026-08-04: Memory Corruption when processing registry values with incorrect types using a direct query method.
• CVE-2026-21379 - CVSS 7.8 (high), 2026-07-06: Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
• CVE-2025-59611 - CVSS 6.7 (medium), 2026-06-01: Memory corruption in diagnostic services due to absence of input validation
• CVE-2026-21374 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
• CVE-2026-21378 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
• CVE-2026-21376 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
• CVE-2026-21373 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
• CVE-2026-21371 - CVSS 7.8 (high), 2026-04-06: Memory Corruption when retrieving output buffer with insufficient size validation.
• CVE-2025-47383 - CVSS 7.2 (high), 2026-03-02: Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2025-47359 - CVSS 7.8 (high), 2026-02-02: Memory Corruption when multiple threads simultaneously access a memory free API.
• CVE-2025-47387 - CVSS 7.8 (high), 2025-12-18: Memory Corruption when processing IOCTLs for JPEG data without verification.
• CVE-2025-27054 - CVSS 7.8 (high), 2025-10-09: Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053 - CVSS 7.8 (high), 2025-10-09: Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-47327 - CVSS 7.8 (high), 2025-09-24: Memory corruption while encoding the image data.
• CVE-2025-47318 - CVSS 7.5 (high), 2025-09-24: Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-47316 - CVSS 7.8 (high), 2025-09-24: Memory corruption due to double free when multiple threads race to set the timestamp store.
• CVE-2025-27032 - CVSS 7.8 (high), 2025-09-24: memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
• CVE-2025-21484 - CVSS 8.2 (high), 2025-09-24: Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
• CVE-2025-21487 - CVSS 8.2 (high), 2025-09-24: Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
• CVE-2025-21483 - CVSS 9.8 (critical), 2025-09-24: Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2025-21481 - CVSS 7.8 (high), 2025-09-24: Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27076 - CVSS 7.8 (high), 2025-08-06: Memory corruption while processing simultaneous requests via escape path.
• CVE-2025-27075 - CVSS 7.8 (high), 2025-08-06: Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-21465 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-27061 - CVSS 7.8 (high), 2025-07-08: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27055 - CVSS 7.8 (high), 2025-07-08: Memory corruption during the image encoding process.
• CVE-2025-27050 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing event close when client process terminates abruptly.
• CVE-2025-27042 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing video packets received from video firmware.
• CVE-2025-21466 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing a private escape command in an event trigger.
• CVE-2025-27046 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing multiple simultaneous escape calls.
• CVE-2025-21427 - CVSS 8.2 (high), 2025-07-08: Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
• CVE-2025-21422 - CVSS 7.8 (high), 2025-07-08: Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
• CVE-2025-21433 - CVSS 6.2 (medium), 2025-07-08: Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
• CVE-2025-21432 - CVSS 7.8 (high), 2025-07-08: Memory corruption while retrieving the CBOR data from TA.
• CVE-2024-53009 - CVSS 7.8 (high), 2025-07-08: Memory corruption while operating the mailbox in Automotive.
• CVE-2024-53026 - CVSS 8.2 (high), 2025-06-03: Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
• CVE-2024-53021 - CVSS 8.2 (high), 2025-06-03: Information disclosure may occur while processing goodbye RTCP packet from network.
• CVE-2024-53020 - CVSS 8.2 (high), 2025-06-03: Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
• CVE-2024-53010 - CVSS 7.8 (high), 2025-06-03: Memory corruption may occur while attaching VM when the HLOS retains access to VM.
• CVE-2025-21475 - CVSS 7.8 (high), 2025-05-06: Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.
• CVE-2025-21470 - CVSS 7.8 (high), 2025-05-06: Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.
• CVE-2025-21453 - CVSS 7.8 (high), 2025-05-06: Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
• CVE-2024-49835 - CVSS 7.8 (high), 2025-05-06: Memory corruption while reading secure file.
• CVE-2024-49842 - CVSS 7.8 (high), 2025-05-06: Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
• CVE-2024-49841 - CVSS 7.8 (high), 2025-05-06: Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21441 - CVSS 7.8 (high), 2025-04-07: Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
• CVE-2025-21440 - CVSS 7.8 (high), 2025-04-07: Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
• CVE-2025-21430 - CVSS 7.5 (high), 2025-04-07: Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
• CVE-2025-21429 - CVSS 7.5 (high), 2025-04-07: Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
• CVE-2025-21421 - CVSS 7.8 (high), 2025-04-07: Memory corruption while processing escape code in API.
• CVE-2025-21423 - CVSS 7.8 (high), 2025-04-07: Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
• CVE-2024-45551 - CVSS 6.2 (medium), 2025-04-07: Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to…
• CVE-2024-33058 - CVSS 7.5 (high), 2025-04-07: Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
• CVE-2024-43046 - CVSS 5.5 (medium), 2025-04-07: There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2025-21424 - CVSS 7.8 (high), 2025-03-03: Memory corruption while calling the NPU driver APIs concurrently.
• CVE-2024-53014 - CVSS 7.8 (high), 2025-03-03: Memory corruption may occur while validating ports and channels in Audio driver.
• CVE-2024-43056 - CVSS 6.5 (medium), 2025-03-03: Transient DOS during hypervisor virtual I/O operation in a virtual machine.
• CVE-2024-43051 - CVSS 5.5 (medium), 2025-03-03: Information disclosure while deriving keys for a session for any Widevine use case.
• CVE-2024-45560 - CVSS 7.8 (high), 2025-02-03: Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
• CVE-2024-38420 - CVSS 8.8 (high), 2025-02-03: Memory corruption while configuring a Hypervisor based input virtual device.
• CVE-2024-45561 - CVSS 7.8 (high), 2025-02-03: Memory corruption while handling IOCTL call from user-space to set latency level.
• CVE-2024-45542 - CVSS 7.8 (high), 2025-01-06: Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
• CVE-2024-45541 - CVSS 7.8 (high), 2025-01-06: Memory corruption when IOCTL call is invoked from user-space to read board data.
• CVE-2024-43050 - CVSS 7.8 (high), 2024-12-02: Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
• CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-33044 - CVSS 8.4 (high), 2024-12-02: Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
• CVE-2024-38423 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing GPU page table switch.
• CVE-2024-38422 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-38407 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.
• CVE-2024-38406 - CVSS 7.8 (high), 2024-11-04: Memory corruption while handling IOCTL calls in JPEG Encoder driver.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33065 - CVSS 8.4 (high), 2024-10-07: Memory corruption while taking snapshot when an offset variable is set by camera driver.
• CVE-2024-33060 - CVSS 8.4 (high), 2024-09-02: Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33052 - CVSS 7.8 (high), 2024-09-02: Memory corruption when user provides data for FM HCI command control operations.
• CVE-2024-33051 - CVSS 7.5 (high), 2024-09-02: Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33043 - CVSS 5.5 (medium), 2024-09-02: Transient DOS while handling PS event when Program Service name length offset value is set to 255.
• CVE-2024-33042 - CVSS 7.8 (high), 2024-09-02: Memory corruption when Alternative Frequency offset value is set to 255.
• CVE-2024-33016 - CVSS 6.8 (medium), 2024-09-02: memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-23362 - CVSS 7.1 (high), 2024-09-02: Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-23359 - CVSS 8.2 (high), 2024-09-02: Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2024-33027 - CVSS 8.4 (high), 2024-08-05: Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-23357 - CVSS 6.2 (medium), 2024-08-05: Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
• CVE-2024-23356 - CVSS 7.8 (high), 2024-08-05: Memory corruption during session sign renewal request calls in HLOS.
• CVE-2024-23353 - CVSS 7.5 (high), 2024-08-05: Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2024-21481 - CVSS 8.4 (high), 2024-08-05: Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
• CVE-2024-23373 - CVSS 8.4 (high), 2024-07-01: Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
• CVE-2024-21469 - CVSS 7.8 (high), 2024-07-01: Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2024-21461 - CVSS 8.4 (high), 2024-07-01: Memory corruption while performing finish HMAC operation when context is freed by keymaster.