Qca6438 Firmware (Qualcomm) - vulnerabilities (CVEs)

105 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-17. Vendor: Qualcomm.

CVEs of Qca6438 Firmware

CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2025-47339 - CVSS 7.8 (high), 2026-01-07: Memory corruption while deinitializing a HDCP session.
CVE-2025-47325 - CVSS 6.5 (medium), 2025-12-18: Information disclosure while processing system calls with invalid parameters.
CVE-2025-27074 - CVSS 8.8 (high), 2025-11-04: Memory corruption while processing a GP command response.
CVE-2025-27040 - CVSS 6.5 (medium), 2025-10-09: Information disclosure may occur while processing the hypervisor log.
CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
CVE-2024-21473 - CVSS 9.8 (critical), 2024-04-01: Memory corruption while redirecting log file to any file location with any file name.
CVE-2023-33105 - CVSS 7.5 (high), 2024-03-04: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
CVE-2023-43536 - CVSS 7.5 (high), 2024-02-06: Transient DOS while parse fils IE with length equal to 1.
CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
CVE-2023-33109 - CVSS 7.5 (high), 2024-01-02: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
CVE-2023-33080 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
CVE-2023-28569 - CVSS 6.1 (medium), 2023-11-07: Information disclosure in WLAN HAL while handling command through WMI interfaces.
CVE-2023-28563 - CVSS 6.1 (medium), 2023-11-07: Information disclosure in IOE Firmware while handling WMI command.
CVE-2023-33027 - CVSS 7.5 (high), 2023-10-03: Transient DOS in WLAN Firmware while parsing rsn ies.
CVE-2023-33015 - CVSS 7.5 (high), 2023-09-05: Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
CVE-2023-28567 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while handling command through WMI interfaces.
CVE-2023-28565 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVE-2023-28544 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
CVE-2023-28558 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN handler while processing PhyID in Tx status handler.
CVE-2023-28564 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
CVE-2023-28557 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
CVE-2023-28560 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
CVE-2023-28549 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
CVE-2023-28559 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
CVE-2022-33275 - CVSS 8.4 (high), 2023-09-05: Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
CVE-2023-21628 - CVSS 8.4 (high), 2023-06-06: Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
CVE-2022-22076 - CVSS 7.1 (high), 2023-06-06: information disclosure due to cryptographic issue in Core during RPMB read request.
CVE-2022-40532 - CVSS 8.4 (high), 2023-04-13: Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
CVE-2022-40531 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
CVE-2022-25655 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
CVE-2022-40512 - CVSS 7.5 (high), 2023-02-12: Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
CVE-2022-33277 - CVSS 8.4 (high), 2023-02-12: Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
CVE-2022-33285 - CVSS 7.5 (high), 2023-01-09: Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
CVE-2022-33286 - CVSS 7.5 (high), 2023-01-09: Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
CVE-2022-33238 - CVSS 7.5 (high), 2022-12-13: Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-33235 - CVSS 8.2 (high), 2022-12-13: Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdragon Compute,…
CVE-2022-33237 - CVSS 7.5 (high), 2022-11-15: Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25736 - CVSS 7.5 (high), 2022-10-19: Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25749 - CVSS 7.5 (high), 2022-10-19: Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25748 - CVSS 9.8 (critical), 2022-10-19: Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2022-25652 - CVSS 9 (critical), 2022-09-16: Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking
CVE-2021-35104 - CVSS 9.8 (critical), 2022-06-14: Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-35071 - CVSS 5.5 (medium), 2022-06-14: Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service in Snapdragon Auto,…
CVE-2021-35088 - CVSS 9.1 (critical), 2022-04-01: Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30324 - CVSS 6.7 (medium), 2022-02-11: Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in Snapdragon Auto,…
CVE-2021-35069 - CVSS 7.8 (high), 2022-02-11: Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-30325 - CVSS 6.7 (medium), 2022-02-11: Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30313 - CVSS 6.7 (medium), 2022-01-13: Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute,…
CVE-2021-30351 - CVSS 9.8 (critical), 2022-01-03: An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon…
CVE-2021-30272 - CVSS 7.8 (high), 2022-01-03: Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto, Snapdragon Compute,…
CVE-2021-30337 - CVSS 8.4 (high), 2022-01-03: Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute,…
CVE-2021-30335 - CVSS 8.4 (high), 2022-01-03: Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon…
CVE-2021-30303 - CVSS 7.8 (high), 2022-01-03: Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30270 - CVSS 7.8 (high), 2022-01-03: Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon…
CVE-2021-30264 - CVSS 6.7 (medium), 2021-11-12: Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…
CVE-2021-1924 - CVSS 9 (critical), 2021-11-12: Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30266 - CVSS 6.7 (medium), 2021-11-12: Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute,…
CVE-2021-1903 - CVSS 5.3 (medium), 2021-11-12: Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon…
CVE-2021-30312 - CVSS 7.5 (high), 2021-10-20: Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30302 - CVSS 7.5 (high), 2021-10-20: Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-30288 - CVSS 8.4 (high), 2021-10-20: Possible stack overflow due to improper length check of TLV while copying the TLV to a local stack variable in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1980 - CVSS 9.1 (critical), 2021-10-20: Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-30260 - CVSS 8.4 (high), 2021-09-17: Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is…
CVE-2021-1976 - CVSS 9.8 (critical), 2021-09-17: A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1971 - CVSS 7.5 (high), 2021-09-09: Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-1974 - CVSS 7.5 (high), 2021-09-09: Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1948 - CVSS 7.5 (high), 2021-09-09: Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1941 - CVSS 7.5 (high), 2021-09-09: Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1909 - CVSS 7.8 (high), 2021-09-09: Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1972 - CVSS 9.8 (critical), 2021-09-08: Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1928 - CVSS 6.1 (medium), 2021-09-08: Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-11301 - CVSS 9.1 (critical), 2021-09-08: Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon…
CVE-2021-1945 - CVSS 7.5 (high), 2021-07-13: Possible out of bound read due to lack of length check of Bandwidth-NSS IE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-1964 - CVSS 7.5 (high), 2021-07-13: Possible buffer over read due to improper validation of IE size while parsing beacon from peer device in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1953 - CVSS 7.5 (high), 2021-07-13: Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon Auto, Snapdragon…
CVE-2021-1943 - CVSS 7.5 (high), 2021-07-13: Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Auto,…
CVE-2021-1938 - CVSS 7.5 (high), 2021-07-13: Possible assertion due to improper verification while creating and deleting the peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1887 - CVSS 7.5 (high), 2021-07-13: An assertion can be reached in the WLAN subsystem while using the Wi-Fi Fine Timing Measurement protocol in Snapdragon Wired Infrastructure and Networking
CVE-2021-1937 - CVSS 7.5 (high), 2021-06-09: Reachable assertion is possible while processing peer association WLAN message from host and nonstandard incoming packet in Snapdragon Auto, Snapdragon…
CVE-2020-11267 - CVSS 8.4 (high), 2021-06-09: Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, Snapdragon…
CVE-2020-11134 - CVSS 9.8 (critical), 2021-06-09: Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a…
CVE-2020-11238 - CVSS 7.5 (high), 2021-06-09: Possible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-11235 - CVSS 7.8 (high), 2021-06-09: Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2020-11159 - CVSS 9.1 (critical), 2021-06-09: Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in…
CVE-2020-11241 - CVSS 7.5 (high), 2021-06-09: Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon…
CVE-2020-11126 - CVSS 9.1 (critical), 2021-06-09: Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1891 - CVSS 8.4 (high), 2021-05-07: A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-1925 - CVSS 7.5 (high), 2021-05-07: Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-11289 - CVSS 7.8 (high), 2021-05-07: Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1915 - CVSS 7.8 (high), 2021-05-07: Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2021-1895 - CVSS 7.8 (high), 2021-05-07: Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVE-2021-1927 - CVSS 8.4 (high), 2021-05-07: Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2020-11296 - CVSS 7.5 (high), 2021-02-22: Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-11269 - CVSS 8.8 (high), 2021-02-22: Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute,…
CVE-2020-11275 - CVSS 9.1 (critical), 2021-02-22: Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon…
CVE-2020-11280 - CVSS 7.5 (high), 2021-02-22: Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improper error handling…
CVE-2020-11204 - CVSS 7.8 (high), 2021-02-22: Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from…
CVE-2020-11271 - CVSS 7.8 (high), 2021-02-22: Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…