Qcs8250 Firmware (Qualcomm) - vulnerabilities (CVEs)

180 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-01-07. Vendor: Qualcomm.

CVEs of Qcs8250 Firmware

• CVE-2025-47334 - CVSS 6.7 (medium), 2026-01-07: Memory corruption while processing shared command buffer packet between camera userspace and kernel.
• CVE-2025-47333 - CVSS 6.6 (medium), 2026-01-07: Memory corruption while handling buffer mapping operations in the cryptographic driver.
• CVE-2025-47331 - CVSS 6.1 (medium), 2026-01-07: Information disclosure while processing a firmware event.
• CVE-2025-47330 - CVSS 5.5 (medium), 2026-01-07: Transient DOS while parsing video packets received from the video firmware.
• CVE-2025-47322 - CVSS 7.8 (high), 2025-12-18: Memory corruption while handling IOCTL calls to set mode.
• CVE-2025-47320 - CVSS 7.8 (high), 2025-12-18: Memory corruption while processing MFC channel configuration during music playback.
• CVE-2025-27063 - CVSS 7.8 (high), 2025-12-18: Memory corruption during video playback when video session open fails with time out error.
• CVE-2025-27054 - CVSS 7.8 (high), 2025-10-09: Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053 - CVSS 7.8 (high), 2025-10-09: Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-47318 - CVSS 7.5 (high), 2025-09-24: Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-27062 - CVSS 7.8 (high), 2025-08-06: Memory corruption while handling client exceptions, allowing unauthorized channel access.
• CVE-2025-21465 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-27061 - CVSS 7.8 (high), 2025-07-08: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27057 - CVSS 7.5 (high), 2025-07-08: Transient DOS while handling beacon frames with invalid IE header length.
• CVE-2025-27052 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing data packets in diag received from Unix clients.
• CVE-2025-27043 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing manipulated payload in video firmware.
• CVE-2025-27042 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing video packets received from video firmware.
• CVE-2025-21432 - CVSS 7.8 (high), 2025-07-08: Memory corruption while retrieving the CBOR data from TA.
• CVE-2025-21433 - CVSS 6.2 (medium), 2025-07-08: Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
• CVE-2025-21463 - CVSS 7.5 (high), 2025-06-03: Transient DOS while processing the EHT operation IE in the received beacon frame.
• CVE-2025-21468 - CVSS 7.8 (high), 2025-05-06: Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of…
• CVE-2025-21459 - CVSS 7.5 (high), 2025-05-06: Transient DOS while parsing per STA profile in ML IE.
• CVE-2024-49844 - CVSS 7.8 (high), 2025-05-06: Memory corruption while triggering commands in the PlayReady Trusted application.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21430 - CVSS 7.5 (high), 2025-04-07: Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
• CVE-2025-21434 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
• CVE-2024-49848 - CVSS 6.7 (medium), 2025-04-07: Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
• CVE-2024-45549 - CVSS 7.7 (high), 2025-04-07: Information disclosure while creating MQ channels.
• CVE-2024-45551 - CVSS 6.2 (medium), 2025-04-07: Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to…
• CVE-2025-21424 - CVSS 7.8 (high), 2025-03-03: Memory corruption while calling the NPU driver APIs concurrently.
• CVE-2024-53027 - CVSS 7.5 (high), 2025-03-03: Transient DOS may occur while processing the country IE.
• CVE-2024-53024 - CVSS 7.8 (high), 2025-03-03: Memory corruption in display driver while detaching a device.
• CVE-2024-53023 - CVSS 7.8 (high), 2025-03-03: Memory corruption may occur while accessing a variable during extended back to back tests.
• CVE-2024-53014 - CVSS 7.8 (high), 2025-03-03: Memory corruption may occur while validating ports and channels in Audio driver.
• CVE-2024-43051 - CVSS 5.5 (medium), 2025-03-03: Information disclosure while deriving keys for a session for any Widevine use case.
• CVE-2024-49838 - CVSS 8.2 (high), 2025-02-03: Information disclosure while parsing the OCI IE with invalid length.
• CVE-2024-49843 - CVSS 7.8 (high), 2025-02-03: Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.
• CVE-2024-49839 - CVSS 9.8 (critical), 2025-02-03: Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2024-45584 - CVSS 7.8 (high), 2025-02-03: Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
• CVE-2024-45553 - CVSS 7.8 (high), 2025-01-06: Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it…
• CVE-2024-43052 - CVSS 7.8 (high), 2024-12-02: Memory corruption while processing API calls to NPU with invalid input.
• CVE-2024-33063 - CVSS 7.5 (high), 2024-12-02: Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
• CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-33044 - CVSS 8.4 (high), 2024-12-02: Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
• CVE-2024-38415 - CVSS 7.8 (high), 2024-11-04: Memory corruption while handling session errors from firmware.
• CVE-2024-38422 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-38421 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing GPU commands.
• CVE-2024-38419 - CVSS 7.8 (high), 2024-11-04: Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33068 - CVSS 7.5 (high), 2024-11-04: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-38405 - CVSS 7.5 (high), 2024-11-04: Transient DOS while processing the CU information from RNR IE.
• CVE-2024-23377 - CVSS 6.7 (medium), 2024-11-04: Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been…
• CVE-2024-38397 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing probe response and assoc response frame.
• CVE-2024-33073 - CVSS 8.2 (high), 2024-10-07: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-38402 - CVSS 7.8 (high), 2024-09-02: Memory corruption while processing IOCTL call for getting group info.
• CVE-2024-33052 - CVSS 7.8 (high), 2024-09-02: Memory corruption when user provides data for FM HCI command control operations.
• CVE-2024-33060 - CVSS 8.4 (high), 2024-09-02: Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33057 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33048 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33051 - CVSS 7.5 (high), 2024-09-02: Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33050 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33042 - CVSS 7.8 (high), 2024-09-02: Memory corruption when Alternative Frequency offset value is set to 255.
• CVE-2024-33045 - CVSS 8.4 (high), 2024-09-02: Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
• CVE-2024-33043 - CVSS 5.5 (medium), 2024-09-02: Transient DOS while handling PS event when Program Service name length offset value is set to 255.
• CVE-2024-33016 - CVSS 6.8 (medium), 2024-09-02: memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-23362 - CVSS 7.1 (high), 2024-09-02: Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-33034 - CVSS 8.4 (high), 2024-08-05: Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at…
• CVE-2024-33028 - CVSS 8.4 (high), 2024-08-05: Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33026 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33020 - CVSS 7.5 (high), 2024-08-05: Transient DOS while processing TID-to-link mapping IE elements.
• CVE-2024-33023 - CVSS 8.4 (high), 2024-08-05: Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
• CVE-2024-33021 - CVSS 8.4 (high), 2024-08-05: Memory corruption while processing IOCTL call to set metainfo.
• CVE-2024-33015 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
• CVE-2024-33013 - CVSS 7.5 (high), 2024-08-05: Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
• CVE-2024-33012 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33010 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-23384 - CVSS 8.4 (high), 2024-08-05: Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
• CVE-2024-33011 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2024-23382 - CVSS 8.4 (high), 2024-08-05: Memory corruption while processing graphics kernel driver request to create DMA fence.
• CVE-2024-23381 - CVSS 8.4 (high), 2024-08-05: Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
• CVE-2024-23357 - CVSS 6.2 (medium), 2024-08-05: Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
• CVE-2024-23383 - CVSS 8.4 (high), 2024-08-05: Memory corruption when kernel driver attempts to trigger hardware fences.
• CVE-2024-23355 - CVSS 7.8 (high), 2024-08-05: Memory corruption when keymaster operation imports a shared key.
• CVE-2024-23380 - CVSS 8.4 (high), 2024-07-01: Memory corruption while handling user packets during VBO bind operation.
• CVE-2024-23373 - CVSS 8.4 (high), 2024-07-01: Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
• CVE-2024-23372 - CVSS 8.4 (high), 2024-07-01: Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2024-21469 - CVSS 7.8 (high), 2024-07-01: Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
• CVE-2024-21462 - CVSS 7.1 (high), 2024-07-01: Transient DOS while loading the TA ELF file.
• CVE-2024-21461 - CVSS 8.4 (high), 2024-07-01: Memory corruption while performing finish HMAC operation when context is freed by keymaster.
• CVE-2024-21465 - CVSS 7.8 (high), 2024-07-01: Memory corruption while processing key blob passed by the user.
• CVE-2023-43555 - CVSS 8.2 (high), 2024-06-03: Information disclosure in Video while parsing mp2 clip with invalid section length.
• CVE-2023-43556 - CVSS 9.3 (critical), 2024-06-03: Memory corruption in Hypervisor when platform information mentioned is not aligned.
• CVE-2023-43542 - CVSS 7.8 (high), 2024-06-03: Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
• CVE-2023-43537 - CVSS 7.5 (high), 2024-06-03: Information disclosure while handling T2LM Action Frame in WLAN Host.