Snapdragon X65 5g Modem-rf System Firmware (Qualcomm) - vulnerabilities (CVEs)

250 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-06. Vendor: Qualcomm.

CVEs of Snapdragon X65 5g Modem-rf System Firmware

• CVE-2026-57554 - CVSS 7.8 (high), 2026-10-06: Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
• CVE-2026-25302 - CVSS 7.1 (high), 2026-10-06: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted…
• CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-25289 - CVSS 9.6 (critical), 2026-08-04: Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
• CVE-2026-24084 - CVSS 7.5 (high), 2026-08-04: Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
• CVE-2026-24079 - CVSS 8.1 (high), 2026-08-04: Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
• CVE-2026-24078 - CVSS 6.5 (medium), 2026-08-04: Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
• CVE-2026-25268 - CVSS 8.8 (high), 2026-07-06: Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2026-24091 - CVSS 7.2 (high), 2026-06-01: Memory corruption while processing fastboot commands with improperly formatted input.
• CVE-2026-24085 - CVSS 7.2 (high), 2026-06-01: Memory Corruption when processing display command line information due to improper initialization of a variable.
• CVE-2025-59609 - CVSS 5.5 (medium), 2026-06-01: Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
• CVE-2025-59605 - CVSS 7.8 (high), 2026-06-01: Memory Corruption when processing device identifier strings that exceed the expected maximum length.
• CVE-2025-59604 - CVSS 7.8 (high), 2026-06-01: Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
• CVE-2025-47392 - CVSS 8.8 (high), 2026-04-06: Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
• CVE-2026-21385 - CVSS 7.8 (high), 2026-03-02: Memory corruption while using alignments for memory allocation.
• CVE-2025-59600 - CVSS 7.8 (high), 2026-03-02: Memory Corruption when adding user-supplied data without checking available buffer space.
• CVE-2025-47383 - CVSS 7.2 (high), 2026-03-02: Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2025-47371 - CVSS 6.5 (medium), 2026-03-02: Transient DOS when an LTE RLC packet with invalid TB is received by UE.
• CVE-2025-47369 - CVSS 5.5 (medium), 2026-01-07: Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
• CVE-2025-47348 - CVSS 7.8 (high), 2026-01-07: Memory corruption while processing identity credential operations in the trusted application.
• CVE-2025-47331 - CVSS 6.1 (medium), 2026-01-07: Information disclosure while processing a firmware event.
• CVE-2025-47330 - CVSS 5.5 (medium), 2026-01-07: Transient DOS while parsing video packets received from the video firmware.
• CVE-2025-47333 - CVSS 6.6 (medium), 2026-01-07: Memory corruption while handling buffer mapping operations in the cryptographic driver.
• CVE-2025-47321 - CVSS 7.8 (high), 2025-12-18: Memory corruption while copying packets received from unix clients.
• CVE-2025-47323 - CVSS 7.8 (high), 2025-12-18: Memory corruption while routing GPR packets between user and root when handling large data packet.
• CVE-2025-27070 - CVSS 7.8 (high), 2025-11-04: Memory corruption while performing encryption and decryption commands.
• CVE-2025-27054 - CVSS 7.8 (high), 2025-10-09: Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053 - CVSS 7.8 (high), 2025-10-09: Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-47326 - CVSS 7.5 (high), 2025-09-24: Transient DOS while handling command data during power control processing.
• CVE-2025-47318 - CVSS 7.5 (high), 2025-09-24: Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-27034 - CVSS 9.8 (critical), 2025-09-24: Memory corruption while selecting the PLMN from SOR failed list.
• CVE-2025-27032 - CVSS 7.8 (high), 2025-09-24: memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
• CVE-2025-21482 - CVSS 7.1 (high), 2025-09-24: Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21481 - CVSS 7.8 (high), 2025-09-24: Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-27062 - CVSS 7.8 (high), 2025-08-06: Memory corruption while handling client exceptions, allowing unauthorized channel access.
• CVE-2025-21477 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing CCCH data when NW sends data with invalid length.
• CVE-2025-21465 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-21463 - CVSS 7.5 (high), 2025-06-03: Transient DOS while processing the EHT operation IE in the received beacon frame.
• CVE-2024-53010 - CVSS 7.8 (high), 2025-06-03: Memory corruption may occur while attaching VM when the HLOS retains access to VM.
• CVE-2024-49841 - CVSS 7.8 (high), 2025-05-06: Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21435 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing extended IE in beacon.
• CVE-2025-21430 - CVSS 7.5 (high), 2025-04-07: Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
• CVE-2025-21429 - CVSS 7.5 (high), 2025-04-07: Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
• CVE-2024-45556 - CVSS 6.5 (medium), 2025-04-07: Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.
• CVE-2024-45551 - CVSS 6.2 (medium), 2025-04-07: Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to…
• CVE-2024-45549 - CVSS 7.7 (high), 2025-04-07: Information disclosure while creating MQ channels.
• CVE-2024-43065 - CVSS 7.1 (high), 2025-04-07: Cryptographic issues while generating an asymmetric key pair for RKP use cases.
• CVE-2024-43046 - CVSS 5.5 (medium), 2025-04-07: There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2024-33058 - CVSS 7.5 (high), 2025-04-07: Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
• CVE-2024-33056 - CVSS 8.4 (high), 2024-12-02: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-33044 - CVSS 8.4 (high), 2024-12-02: Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
• CVE-2024-33063 - CVSS 7.5 (high), 2024-12-02: Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
• CVE-2024-38423 - CVSS 7.8 (high), 2024-11-04: Memory corruption while processing GPU page table switch.
• CVE-2024-38415 - CVSS 7.8 (high), 2024-11-04: Memory corruption while handling session errors from firmware.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33068 - CVSS 7.5 (high), 2024-11-04: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-23385 - CVSS 7.5 (high), 2024-11-04: Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.
• CVE-2024-38397 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing probe response and assoc response frame.
• CVE-2024-33073 - CVSS 8.2 (high), 2024-10-07: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33066 - CVSS 9.8 (critical), 2024-10-07: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2024-33049 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-23369 - CVSS 7.8 (high), 2024-10-07: Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
• CVE-2024-38402 - CVSS 7.8 (high), 2024-09-02: Memory corruption while processing IOCTL call for getting group info.
• CVE-2024-33060 - CVSS 8.4 (high), 2024-09-02: Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33057 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33050 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33048 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33051 - CVSS 7.5 (high), 2024-09-02: Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33045 - CVSS 8.4 (high), 2024-09-02: Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
• CVE-2024-33016 - CVSS 6.8 (medium), 2024-09-02: memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-23364 - CVSS 7.5 (high), 2024-09-02: Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is…
• CVE-2024-23362 - CVSS 7.1 (high), 2024-09-02: Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-23359 - CVSS 8.2 (high), 2024-09-02: Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33026 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33023 - CVSS 8.4 (high), 2024-08-05: Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
• CVE-2024-33015 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
• CVE-2024-33019 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping action frame.
• CVE-2024-33018 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33012 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33013 - CVSS 7.5 (high), 2024-08-05: Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
• CVE-2024-33011 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2024-33010 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-23357 - CVSS 6.2 (medium), 2024-08-05: Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
• CVE-2024-23353 - CVSS 7.5 (high), 2024-08-05: Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2024-23352 - CVSS 7.5 (high), 2024-08-05: Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
• CVE-2024-23356 - CVSS 7.8 (high), 2024-08-05: Memory corruption during session sign renewal request calls in HLOS.
• CVE-2024-23355 - CVSS 7.8 (high), 2024-08-05: Memory corruption when keymaster operation imports a shared key.
• CVE-2024-21467 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon probe frame during scan entry generation in client side.
• CVE-2024-21481 - CVSS 8.4 (high), 2024-08-05: Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
• CVE-2024-21459 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon or probe response frame in STA.
• CVE-2024-23373 - CVSS 8.4 (high), 2024-07-01: Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
• CVE-2024-21482 - CVSS 7.8 (high), 2024-07-01: Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
• CVE-2024-21469 - CVSS 7.8 (high), 2024-07-01: Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.