CVE-2021-1905

CVE-2021-1905 is a memory-management vulnerability (use-after-free) in Qualcomm Snapdragon chipsets caused by improper handling of memory mapping across multiple processes. Affects a broad range of Snapdragon products (Auto, Compute, Connectivity, IoT, Mobile, Wearables, etc.). The CVE is charact...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2022-40503

CVE-2022-40503 is a buffer over-read vulnerability in the Bluetooth Host during A2DP streaming, described as information disclosure. It affects Qualcomm components (Bluetooth) and is referenced in Qualcomm security bulletins; public details appear in NVD and Red Hat/CVE cross references. Remediat...

CVE-2023-33063

CVE-2023-33063 is a Use-After-Free/memory corruption issue in Qualcomm DSP Services triggered by a remote call from HLOS to DSP. Affected: Qualcomm chipsets with DSP Services; root cause: memory corruption leading to potential unintended behavior. Documents indicate high impact (confidentiality, ...

CVE-2023-33106

CVE-2023-33106 is a memory corruption vulnerability in Qualcomm graphics drivers, caused by an out-of-range pointer offset when submitting a large list of sync points to IOCTL_KGSL_GPU_AUX_COMMAND. Affected component is Qualcomm chipsets’ graphics subsystem (KGSL driver). The issue is locally exp...

CVE-2023-33107

CVE-2023-33107 is an integer overflow/memory-corruption vulnerability in Graphics Linux affecting Qualcomm display components. The flaw occurs when assigning a shared virtual memory region during an IOCTL, enabling local attacker access with low complexity and no user interaction; impact is rated...

CVE-2024-43047

CVE-2024-43047 is a memory corruption (use-after-free) issue in Qualcomm DSP driver ADSPRPC that handles DMA-mapped memory between the host OS and DSP. Public reports describe multiple kernel panics and memory-safety failures tied to fastrpc_mmap and related structures (fastrpc_mmap, fastrpc_file...

CVE-2022-22065

CVE-2022-22065 is a Qualcomm Snapdragon WLAN-Host vulnerability characterized by an out-of-bounds read due to an improper length check, leading to Denial of Service. The CVE is listed under Qualcomm components for the May 2022 Android security updates as a High-severity WLAN issue. Connected sour...

CVE-2021-1931

CVE-2021-1931 is a buffer overflow in Qualcomm SDM660 bootloader processing of fastboot/flash data. The exploit arose from improper handling of large payloads in the bootloader’s flash: command, enabling memory corruption that could bypass signature checks and unlock the bootloader on SDM660 devi...

CVE-2022-22080

The CVE-2022-22080 entry concerns Qualcomm Snapdragon firmware: improper validation of a backend id in the PCM routing process can cause memory corruption across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music components. Root cause is memory-corrup...

CVE-2021-35117

CVE-2021-35117 is associated with Qualcomm Snapdragon WLAN components. Description indicates an out-of-bounds read may occur while processing an IBSS beacon across multiple Snapdragon lines (Auto, Compute, Connectivity, C.I.O.T., Industrial IOT, Mobile, Voice & Music). The CVE is listed in Qualco...

CVE-2022-22068

CVE-2022-22068 affects Qualcomm/ Snapdragon kernel components. The issue arises when a kernel event contains content not generated by NPU software during asynchronous execution, potentially enabling local escalation of privileges with high impact (confidentiality, integrity, and availability all ...

CVE-2021-35123

CVE-2021-35123 is a Qualcomm closed‑source component vulnerability: a buffer copy in GATT multi-notification due to an improper length check in data over-the-air for Snapdragon Connectivity and Snapdragon Industrial IOT. The issue affects Bluetooth/GATT processing and yields high impact across co...

CVE-2021-35105

CVE-2021-35105 is a graphics profiling input-validation issue leading to possible out-of-bounds access in Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Vision/Music, Wearables). Connected sources attribute the flaw to improper input handling in...

CVE-2022-22088

CVE-2022-22088 is a memory corruption vulnerability in the Qualcomm Bluetooth HOST component caused by a buffer overflow while parsing a remote command response. Reported in the Qualcomm January 2023 Security Bulletin, the issue affects devices using certain Qualcomm chipsets and has a CVSS of 9....

CVE-2025-21424

CVE-2025-21424 affects Qualcomm MSM NPU kernel driver. Root cause: memory corruption due to concurrent calls to NPU driver APIs (race condition between NPU host unload and exec paths cited by PacketStorm). Impact described as memory corruption with local access and high confidentiality/integrity/...

CVE-2021-30342

CVE-2021-30342 is a Qualcomm closed‑source component issue described as an improper integrity check that can cause a race condition between the PDCP and RRC tasks after a valid RRC Command packet is received. Documents indicate an impact in Snapdragon-family devices (Auto/Compute/Consumer IoT/Ind...

CVE-2020-11239

CVE-2020-11239 describes a use-after-free when importing a DMA buffer using the CPU address due to an attachment not being cleaned up. Affected are Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root caus...

CVE-2021-35088

CVE-2021-35088 : An out-of-bounds read due to improper validation of the SSID IE length during SSID IE parsing when the channel is DFS, reported for Qualcomm Snapdragon families (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Wearables, Wired Infrastructure and Networking). Th...

CVE-2021-30351

CVE-2021-30351 is an out-of-bounds memory access in Qualcomm/Snapdragon audio decoders triggered by improper validation of the number of frames during music playback. The NVD entry and Red Hat bulletin describe a critical issue with CVSS 3.1 score of 9.8 (NETWORK, LOW attack complexity, NONE priv...

CVE-2023-21670

CVE-2023-21670 describes memory corruption in the Qualcomm GPU subsystem caused by arbitrary command execution from the GPU when operating in privileged mode. The CVE is documented with a HIGH impact (confidentiality, integrity, and availability) and a LOCAL attack vector with LOW complexity and ...

CVE-2021-30334

CVE-2021-30334 describes a use-after-free in Qualcomm Snapdragon DRM handling caused by a missing null check of DRM file status after the file structure is freed. Affected products include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Voice & Music, and Wearables. The vuln...

CVE-2022-33243

The CVE-2022-33243 entry describes memory corruption due to improper access control in Qualcomm IPC. Public records in this set identify Qualcomm IPC as the affected component and characterize the vulnerability as memory corruption arising from access-control weaknesses, with high impact on confi...

CVE-2021-35106

CVE-2021-35106 describes a Qualcomm Snapdragon vulnerability caused by an improper length calculation of a WMI message, leading to a possible out-of-bounds read. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables. The ...

CVE-2024-23373

CVE-2024-23373 is a memory corruption/Use-After-Free issue in Qualcomm graphics stack related to IOMMU unmap handling, where a failed unmap can cause DMA/anonymous buffers to be released. Public sources assign a HIGH impact with local attack requirements (no user interaction). The CVE is document...

CVE-2023-21657

CVE-2023-21657 describes memory corruption in Qualcomm Audio when the ADSP receives input during a recording use case. Affected component: Qualcomm audio stack (Audio/ADSP). Root cause: memory corruption in the audio path during input handling in record mode. Impact: high across confidentiality, ...

CVE-2023-21665

CVE-2023-21665 describes memory corruption in the Qualcomm Adreno KGSL graphics driver. The connected packetstorm entry details an unchecked cast of vma->vm_file->private_data in kgsl_setup_dmabuf_useraddr(), which is reachable via IOCTL_KGSL_MAP_USER_MEM and can bypass sanity checks on VMA...

CVE-2021-1945

CVE-2021-1945 describes a possible out-of-bounds read in Qualcomm Snapdragon firmware, caused by a missing length check for the Bandwidth-NSS IE across multiple Snapdragon lines (Auto/Compute/Connectivity/IoT/Industrial IoT/Mobile/Voice & Music/ Wired Infrastructure). The vulnerability affects Qu...

CVE-2023-21666

CVE-2023-21666 refers to memory corruption in graphics when accessing a buffer allocated through the graphics pool, tied to Qualcomm Adreno KGSL. The PacketStorm article documents a vulnerability class where, on KGSL builds without CONFIG_QCOM_KGSL_USE_SHMEM (or older KGSL versions without it), G...

CVE-2021-35068

CVE-2021-35068 involves a NULL pointer dereference caused by a missing null check when freeing the device information buffer in the Bluetooth HFP protocol. Affected product families are Qualcomm Snapdragon lines: Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Voice & Music, and Wearab...

CVE-2021-35069

CVE-2021-35069 describes an improper validation of data length received from a DMA buffer that can cause memory corruption in Qualcomm Snapdragon products. Affected families include Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and WIN (Snapdragon ha...

CVE-2022-25743

CVE-2022-25743 is a memory corruption via use-after-free in KGSL during graphics buffer import on Qualcomm Snapdragon GPUs (multiple Snapdragon lines). Affected component is graphics driver; root cause is use-after-free leading to potential memory corruption with high impact. CVSS vectors indicat...

CVE-2022-33213

CVE-2022-33213 refers to a memory corruption in a Qualcomm closed‑source modem component triggered by a buffer overflow while processing a PPP packet. Affected asset class: Qualcomm modem (closed‑source) within Snapdragon devices; underlying cause: memory corruption due to buffer overflow; potent...

CVE-2023-43513

CVE-2023-43513: Memory corruption in Qualcomm components due to an untrusted context read pointer during event-ring processing, which may be advanced with arbitrary values and point to the middle of a ring element. According to the provided data, the CVSS v3.1 base metrics are HIGH for Confidenti...

CVE-2020-11290

CVE-2020-11290 is a use-after-free in Qualcomm MSM ioctl event handling caused by a race between ioctl register and deregister. Affected are Snapdragon products including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Wearables. The issue stems from contention in the ioctl...

CVE-2021-1943

CVE-2021-1943 describes a buffer out-of-bounds read due to improper TBTT count/length validation when parsing beacon responses in Qualcomm Snapdragon WLAN components across Snapdragon Auto, Compute, Connectivity, Industrial IOT, Mobile, and Wired Infrastructure and Networking. The vulnerability d...

CVE-2020-11240

CVE-2020-11240 describes a memory corruption issue in Qualcomm Snapdragon components triggered by an ioctl command with an incorrect copy size. The vulnerability affects a broad set of Snapdragon products (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables...

CVE-2021-1940

CVE-2021-1940 affects Qualcomm Snapdragon devices across multiple product lines. The root cause is improper handling of responses from firmware, leading to a use-after-free condition that can impact confidentiality, integrity, and availability. The connected documents confirm the issue and impact...

CVE-2021-1907

CVE-2021-1907 is a buffer overflow vulnerability caused by a missing length check in BA requests in Qualcomm Snapdragon platforms (Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile). The issue affects Qualcomm‑based Snapdragon components and is described in Qualcomm’s July 2...

CVE-2021-1955

CVE-2021-1955 describes a Denial of Service in Qualcomm’s Snapdragon stack caused by improper handling of connections when an association is rejected. The issue affects Snapdragon Auto/Compute/Connectivity and related Snapdragon lines (IoT, Wearables, Mobile, etc.). Root cause: mishandling of con...

CVE-2022-33255

CVE-2022-33255 is a buffer over-read information-disclosure issue in the Bluetooth HOST when processing GetFolderItems and GetItemAttribute Cmds from a peer device. The CVE is listed in Qualcomm’s security bulletin with a High severity for Bluetooth, and is described as a information-disclosure v...

CVE-2022-22075

CVE-2022-22075 concerns Information Disclosure in Graphics during GPU context switch, with affected component listed as Qualcomm Display. The CVE is documented in multiple sources, including NVD and Qualcomm security references, indicating a vulnerability in the graphics/GPU context switch pathwa...

CVE-2022-40537

CVE-2022-40537 is a memory corruption issue in the Bluetooth HOST when handling the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response. The connected sources identify this as affecting Qualcomm Bluetooth components (e.g., Snapdragon) and classify the issue under Bluetooth with a high/critical impa...

CVE-2023-21669

CVE-2023-21669 affects Qualcomm WLAN components. The root cause is a buffer over-read in the WLAN HOST when processing a DPP action frame to a peer with an invalid source address, leading to information disclosure. CVSS base metrics in available records indicate HIGH impact to confidentiality (C)...

CVE-2021-1964

CVE-2021-1964 corresponds to a buffer over-read in Qualcomm WLAN/IEEE 802.11 beacon parsing due to improper validation of IE size in the WLAN host subsystem. Affected are Qualcomm Snapdragon/WLAN components (e.g., QCA6574AU and related chips) across multiple Snapdragon device families. Root cause...

CVE-2023-33120

CVE-2023-33120 affects Qualcomm ADSP Audio: memory corruption occurs when a memory map command is executed consecutively. This is described across multiple sources (NVD/Red Hat/RH advisories) as a memory corruption in Audio due to repeated memory-mapping commands. The CVSS-based description in th...

CVE-2021-1970

CVE-2021-1970 relates to an out-of-bounds read in Qualcomm WLAN/Qualcomm Snapdragon subsystems caused by insufficient length checks for FT sub-elements. Affected products include Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music lineages and WLAN components. Th...

CVE-2023-33059

Mode C: CVE-2023-33059 concerns memory corruption in the Audio component when processing VOC packet data from ADSP, affecting Qualcomm audio/ADSP stacks. Root cause cited across connected sources as a buffer/memory handling issue in VOC packet processing with high impact on confidentiality, integ...

CVE-2023-22387

CVE-2023-22387 describes an arbitrary memory overwrite when a VM is compromised during a TX write, causing memory corruption. The most concrete details in the connected docs are: (1) it is listed under Qualcomm components, specifically in the Qualcomm kernel area, with a high impact and Local att...