Snapdragon 865+ 5g Mobile Platform Firmware (Qualcomm) - vulnerabilities (CVEs)

106 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-06. Vendor: Qualcomm.

CVEs of Snapdragon 865+ 5g Mobile Platform Firmware

• CVE-2026-25302 - CVSS 7.1 (high), 2026-10-06: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted…
• CVE-2026-25267 - CVSS 7.8 (high), 2026-10-06: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
• CVE-2026-25263 - CVSS 6.6 (medium), 2026-10-06: Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
• CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-24084 - CVSS 7.5 (high), 2026-08-04: Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
• CVE-2026-24079 - CVSS 8.1 (high), 2026-08-04: Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
• CVE-2026-24078 - CVSS 6.5 (medium), 2026-08-04: Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
• CVE-2026-24077 - CVSS 6.5 (medium), 2026-08-04: Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
• CVE-2026-25277 - CVSS 8.8 (high), 2026-06-01: Memory corruption while using Strongbox due to buffer overflow.
• CVE-2026-25276 - CVSS 8.8 (high), 2026-06-01: Memory corruption while using Strongbox due to missing bounds check.
• CVE-2026-24091 - CVSS 7.2 (high), 2026-06-01: Memory corruption while processing fastboot commands with improperly formatted input.
• CVE-2026-24085 - CVSS 7.2 (high), 2026-06-01: Memory Corruption when processing display command line information due to improper initialization of a variable.
• CVE-2025-59610 - CVSS 6.4 (medium), 2026-06-01: Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
• CVE-2025-59605 - CVSS 7.8 (high), 2026-06-01: Memory Corruption when processing device identifier strings that exceed the expected maximum length.
• CVE-2025-59604 - CVSS 7.8 (high), 2026-06-01: Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
• CVE-2025-47392 - CVSS 8.8 (high), 2026-04-06: Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
• CVE-2025-47389 - CVSS 7.8 (high), 2026-04-06: Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
• CVE-2026-21385 - CVSS 7.8 (high), 2026-03-02: Memory corruption while using alignments for memory allocation.
• CVE-2025-47386 - CVSS 7.8 (high), 2026-03-02: Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
• CVE-2025-47384 - CVSS 6.5 (medium), 2026-03-02: Transient DOS when MAC configures config id greater than supported maximum value.
• CVE-2025-47383 - CVSS 7.2 (high), 2026-03-02: Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2025-47378 - CVSS 7.1 (high), 2026-03-02: Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.
• CVE-2025-47379 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
• CVE-2025-47376 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
• CVE-2025-47375 - CVSS 7.8 (high), 2026-03-02: Memory corruption while handling different IOCTL calls from the user-space simultaneously.
• CVE-2025-47371 - CVSS 6.5 (medium), 2026-03-02: Transient DOS when an LTE RLC packet with invalid TB is received by UE.
• CVE-2024-43052 - CVSS 7.8 (high), 2024-12-02: Memory corruption while processing API calls to NPU with invalid input.
• CVE-2024-33044 - CVSS 8.4 (high), 2024-12-02: Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
• CVE-2024-33040 - CVSS 7 (high), 2024-12-02: Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer…
• CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-33053 - CVSS 6.7 (medium), 2024-12-02: Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
• CVE-2024-33037 - CVSS 6.1 (medium), 2024-12-02: Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
• CVE-2024-33036 - CVSS 6.7 (medium), 2024-12-02: Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to…
• CVE-2024-38423 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing GPU page table switch.
• CVE-2024-38415 - CVSS 7.8 (high), 2024-11-04: Memory corruption while handling session errors from firmware.
• CVE-2024-38422 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33032 - CVSS 6.7 (medium), 2024-11-04: Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
• CVE-2024-33043 - CVSS 5.5 (medium), 2024-09-02: Transient DOS while handling PS event when Program Service name length offset value is set to 255.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33020 - CVSS 7.5 (high), 2024-08-05: Transient DOS while processing TID-to-link mapping IE elements.
• CVE-2024-33023 - CVSS 8.4 (high), 2024-08-05: Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-23357 - CVSS 6.2 (medium), 2024-08-05: Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
• CVE-2023-43536 - CVSS 7.5 (high), 2024-02-06: Transient DOS while parse fils IE with length equal to 1.
• CVE-2023-43522 - CVSS 7.5 (high), 2024-02-06: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
• CVE-2023-43533 - CVSS 7.5 (high), 2024-02-06: Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
• CVE-2023-43523 - CVSS 7.5 (high), 2024-02-06: Transient DOS while processing 11AZ RTT management action frame received through OTA.
• CVE-2023-43513 - CVSS 7.8 (high), 2024-02-06: Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to…
• CVE-2023-43519 - CVSS 9.8 (critical), 2024-02-06: Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
• CVE-2023-43518 - CVSS 9.8 (critical), 2024-02-06: Memory corruption in video while parsing invalid mp2 clip.
• CVE-2023-33072 - CVSS 9.3 (critical), 2024-02-06: Memory corruption in Core while processing control functions.
• CVE-2023-33069 - CVSS 7.8 (high), 2024-02-06: Memory corruption in Audio while processing the calibration data returned from ACDB loader.
• CVE-2023-33077 - CVSS 7.8 (high), 2024-02-06: Memory corruption in HLOS while converting from authorization token to HIDL vector.
• CVE-2023-33068 - CVSS 7.8 (high), 2024-02-06: Memory corruption in Audio while processing IIR config data from AFE calibration block.
• CVE-2023-33076 - CVSS 7.8 (high), 2024-02-06: Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
• CVE-2023-33067 - CVSS 7.8 (high), 2024-02-06: Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
• CVE-2023-33049 - CVSS 7.5 (high), 2024-02-06: Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
• CVE-2023-33065 - CVSS 7.1 (high), 2024-02-06: Information disclosure in Audio while accessing AVCS services from ADSP payload.
• CVE-2023-33064 - CVSS 5.5 (medium), 2024-02-06: Transient DOS in Audio when invoking callback function of ASM driver.
• CVE-2023-33057 - CVSS 7.5 (high), 2024-02-06: Transient DOS in Multi-Mode Call Processor while processing UE policy container.
• CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
• CVE-2023-33118 - CVSS 7.8 (high), 2024-01-02: Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
• CVE-2023-33117 - CVSS 7.8 (high), 2024-01-02: Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
• CVE-2023-33114 - CVSS 8.4 (high), 2024-01-02: Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
• CVE-2023-33120 - CVSS 7.8 (high), 2024-01-02: Memory corruption in Audio when memory map command is executed consecutively in ADSP.
• CVE-2023-33110 - CVSS 7.8 (high), 2024-01-02: The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may…
• CVE-2023-33109 - CVSS 7.5 (high), 2024-01-02: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
• CVE-2023-33094 - CVSS 8.4 (high), 2024-01-02: Memory corruption while running VK synchronization with KASAN enabled.
• CVE-2023-33062 - CVSS 7.5 (high), 2024-01-02: Transient DOS in WLAN Firmware while parsing a BTM request.
• CVE-2023-33040 - CVSS 7.5 (high), 2024-01-02: Transient DOS in Data Modem during DTLS handshake.
• CVE-2023-33038 - CVSS 7.8 (high), 2024-01-02: Memory corruption while receiving a message in Bus Socket Transport Server.
• CVE-2023-33037 - CVSS 7.1 (high), 2024-01-02: Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
• CVE-2023-33036 - CVSS 7.1 (high), 2024-01-02: Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
• CVE-2023-33033 - CVSS 8.4 (high), 2024-01-02: Memory corruption in Audio during playback with speaker protection.
• CVE-2023-33030 - CVSS 9.3 (critical), 2024-01-02: Memory corruption in HLOS while running playready use-case.
• CVE-2023-33092 - CVSS 8.4 (high), 2023-12-05: Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
• CVE-2023-33107 - CVSS 8.4 (high), 2023-12-05: Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
• CVE-2023-33106 - CVSS 8.4 (high), 2023-12-05: Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
• CVE-2023-33098 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33089 - CVSS 7.5 (high), 2023-12-05: Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2023-33088 - CVSS 8.4 (high), 2023-12-05: Memory corruption when processing cmd parameters while parsing vdev.
• CVE-2023-28588 - CVSS 7.5 (high), 2023-12-05: Transient DOS in Bluetooth Host while rfc slot allocation.
• CVE-2023-28585 - CVSS 8.8 (high), 2023-12-05: Memory corruption while loading an ELF segment in TEE Kernel.
• CVE-2023-28551 - CVSS 7.8 (high), 2023-12-05: Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
• CVE-2023-28587 - CVSS 7.8 (high), 2023-12-05: Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
• CVE-2023-28586 - CVSS 6.5 (medium), 2023-12-05: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
• CVE-2023-22668 - CVSS 7.8 (high), 2023-12-05: Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
• CVE-2023-22383 - CVSS 7.8 (high), 2023-12-05: Memory Corruption in camera while installing a fd for a particular DMA buffer.
• CVE-2023-28550 - CVSS 7.8 (high), 2023-12-05: Memory corruption in MPP performance while accessing DSM watermark using external memory address.
• CVE-2023-21634 - CVSS 7.8 (high), 2023-12-05: Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
• CVE-2023-28546 - CVSS 7.8 (high), 2023-12-05: Memory Corruption in SPS Application while exporting public key in sorter TA.
• CVE-2023-33045 - CVSS 9.8 (critical), 2023-11-07: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
• CVE-2023-28572 - CVSS 8.8 (high), 2023-11-07: Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
• CVE-2023-28570 - CVSS 7.8 (high), 2023-11-07: Memory corruption while processing audio effects.
• CVE-2023-28556 - CVSS 7.8 (high), 2023-11-07: Cryptographic issue in HLOS during key management.
• CVE-2023-28554 - CVSS 6.1 (medium), 2023-11-07: Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
• CVE-2023-28545 - CVSS 8.2 (high), 2023-11-07: Memory corruption in TZ Secure OS while loading an app ELF.
• CVE-2023-24852 - CVSS 8.4 (high), 2023-11-07: Memory Corruption in Core due to secure memory access by user while loading modem image.