Qualcomm Inc Snapdragon vulnerabilities

CVE-2023-21654 [HIGH] CWE-119 CVE-2023-21654: Memory corruption in Audio during playback session with audio effects enabled. Memory corruption in Audio during playback session with audio effects enabled.

CVE-2022-40524 [HIGH] CWE-126 CVE-2022-40524: Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service. Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.

CVE-2023-21638 [HIGH] CWE-704 CVE-2023-21638: Memory corruption in Video while calling APIs with different instance ID than the one received in in Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.

CVE-2022-33240 [HIGH] CWE-704 CVE-2022-33240: Memory corruption in Audio due to incorrect type cast during audio use-cases. Memory corruption in Audio due to incorrect type cast during audio use-cases.

CVE-2022-33281 [HIGH] CWE-129 CVE-2022-33281: Memory corruption due to improper validation of array index in computer vision while testing EVA ker Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.

CVE-2022-33296 [HIGH] CWE-680 CVE-2022-33296: Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.

CVE-2022-33301 [HIGH] CWE-704 CVE-2022-33301: Memory corruption due to incorrect type conversion or cast in audio while using audio playback/captu Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.

CVE-2018-11816 [HIGH] CWE-416 CVE-2018-11816: Crafted Binder Request Causes Heap UAF in MediaServer Crafted Binder Request Causes Heap UAF in MediaServer

CVE-2018-11952 [HIGH] CWE-287 CVE-2018-11952: An image with a version lower than the fuse version may potentially be booted lead to improper authe An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

CVE-2016-10408 [HIGH] CWE-284 CVE-2016-10408: QSEE will randomly experience a fatal error during execution due to speculative instruction fetches QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.

CVE-2025-47366 [HIGH] CWE-749 CVE-2025-47366: Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrec Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

CVE-2022-33231 [HIGH] CWE-415 CVE-2022-33231: Memory corruption due to double free in core while initializing the encryption key. Memory corruption due to double free in core while initializing the encryption key.

CVE-2023-33105 [HIGH] CWE-16 CVE-2023-33105: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent wit Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.

CVE-2026-25292 [HIGH] CWE-1286 CVE-2026-25292: Memory Corruption when processing untrusted user input in the fastboot command handler for audio fra Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

CVE-2023-33062 [HIGH] CWE-126 CVE-2023-33062: Transient DOS in WLAN Firmware while parsing a BTM request. Transient DOS in WLAN Firmware while parsing a BTM request.

CVE-2024-49838 [HIGH] CWE-126 CVE-2024-49838: Information disclosure while parsing the OCI IE with invalid length. Information disclosure while parsing the OCI IE with invalid length.

CVE-2024-33057 [HIGH] CWE-126 CVE-2024-33057: Transient DOS while parsing the multi-link element Control field when common information length chec Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

CVE-2025-47328 [HIGH] CWE-126 CVE-2025-47328: Transient DOS while processing power control requests with invalid antenna or stream values. Transient DOS while processing power control requests with invalid antenna or stream values.

CVE-2025-47401 [HIGH] CWE-126 CVE-2025-47401: Transient DOS when processing target power rate tables during channel configuration. Transient DOS when processing target power rate tables during channel configuration.

CVE-2026-21367 [HIGH] CWE-126 CVE-2026-21367: Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes durin Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.