CVE-2021-35079

CVE-2021-35079 describes improper validation of permissions for a third-party app attempting to access the Telephony service API, leading to information disclosure on Qualcomm/Snapdragon platforms (Compute, Connectivity, IoT variants). The underlying issue is privilege/permission validation for t...

CVE-2022-22071

CVE-2022-22071 describes a use-after-free condition in Qualcomm Snapdragon chipsets where process shell memory is freed via IOCTL munmap during initialization. Affected lines include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music families. The vuln...

CVE-2022-22057

CVE-2022-22057 (Qualcomm KGSL) is a use-after-free race condition in the Graphics Fence handling caused by closing the fence file descriptor and destroying the graphics timeline concurrently in Qualcomm’s KGSL driver. Affected products span Snapdragon Auto, Compute, Connectivity, Industrial IoT, ...

CVE-2022-22065

CVE-2022-22065 is a Qualcomm Snapdragon WLAN-Host vulnerability characterized by an out-of-bounds read due to an improper length check, leading to Denial of Service. The CVE is listed under Qualcomm components for the May 2022 Android security updates as a High-severity WLAN issue. Connected sour...

CVE-2022-22080

The CVE-2022-22080 entry concerns Qualcomm Snapdragon firmware: improper validation of a backend id in the PCM routing process can cause memory corruption across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music components. Root cause is memory-corrup...

CVE-2022-22068

CVE-2022-22068 affects Qualcomm/ Snapdragon kernel components. The issue arises when a kernel event contains content not generated by NPU software during asynchronous execution, potentially enabling local escalation of privileges with high impact (confidentiality, integrity, and availability all ...

CVE-2022-22088

CVE-2022-22088 is a memory corruption vulnerability in the Qualcomm Bluetooth HOST component caused by a buffer overflow while parsing a remote command response. Reported in the Qualcomm January 2023 Security Bulletin, the issue affects devices using certain Qualcomm chipsets and has a CVSS of 9....

CVE-2021-30342

CVE-2021-30342 is a Qualcomm closed‑source component issue described as an improper integrity check that can cause a race condition between the PDCP and RRC tasks after a valid RRC Command packet is received. Documents indicate an impact in Snapdragon-family devices (Auto/Compute/Consumer IoT/Ind...

CVE-2022-22096

CVE-2022-22096 is a Qualcomm Bluetooth vulnerability in the Bluetooth HOST on Snapdragon platforms (Connectivity + Snapdragon Mobile) caused by a stack-based buffer overflow when extracting data via the command length parameter, leading to memory corruption. It is rated Critical (CVSS v3.1: 9.8, ...

CVE-2022-25743

CVE-2022-25743 is a memory corruption via use-after-free in KGSL during graphics buffer import on Qualcomm Snapdragon GPUs (multiple Snapdragon lines). Affected component is graphics driver; root cause is use-after-free leading to potential memory corruption with high impact. CVSS vectors indicat...

CVE-2022-33213

CVE-2022-33213 refers to a memory corruption in a Qualcomm closed‑source modem component triggered by a buffer overflow while processing a PPP packet. Affected asset class: Qualcomm modem (closed‑source) within Snapdragon devices; underlying cause: memory corruption due to buffer overflow; potent...

CVE-2022-22095

CVE-2022-22095 describes memory corruption in the Qualcomm synx driver due to a use-after-free condition when accessing object handles without acquiring a lock. Affected components include the Qualcomm synx driver used in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, and...

CVE-2022-22075

CVE-2022-22075 concerns Information Disclosure in Graphics during GPU context switch, with affected component listed as Qualcomm Display. The CVE is documented in multiple sources, including NVD and Qualcomm security references, indicating a vulnerability in the graphics/GPU context switch pathwa...

CVE-2022-40537

CVE-2022-40537 is a memory corruption issue in the Bluetooth HOST when handling the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response. The connected sources identify this as affecting Qualcomm Bluetooth components (e.g., Snapdragon) and classify the issue under Bluetooth with a high/critical impa...

CVE-2022-22085

CVE-2022-22085 corresponds to memory corruption in the video subsystem due to a buffer overflow when reading the DTS file on Qualcomm Snapdragon family devices (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root cause is a buffer over...

CVE-2022-25724

CVE-2022-25724 describes a memory corruption issue caused by a buffer overflow while validating the user address in Qualcomm Snapdragon graphics stack, affecting Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. The publicly documented imp...

CVE-2022-33214

CVE-2022-33214 concerns memory corruption in the Qualcomm display stack caused by a time-of-check/time-of-use issue with metadata reserved size in Snapdragon devices (Auto/Compute/IoT/Wearables). Affected products include Snapdragon-based displays in Qualcomm components; root cause is TOCTOU in m...

CVE-2022-22064

CVE-2022-22064 concerns a buffer over-read stemming from insufficient size validation when unpacking a frame in Qualcomm’s Snapdragon family (Auto, Compute, Connectivity, CE Connectivity, C-IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The vulnerability affects Qualcomm’s WLAN/frame-pro...

CVE-2022-25706

CVE-2022-25706 describes information disclosure caused by a buffer over-read in the Qualcomm Bluetooth driver when reading the L2CAP length on Snapdragon devices (Auto/Compute/Connectivity/Consumer/Industrial IoT/Mobile/Wearables). The vulnerability concerns the Bluetooth stack within Qualcomm co...

CVE-2022-25741

CVE-2022-25741 is a Qualcomm Snapdragon DoS issue (null pointer dereference) affecting Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Wearables. Root cause: null pointer dereference when accessing a memory location. Impact: Denial of service. Public details on a...

CVE-2021-35119

CVE-2021-35119 relates to a Qualcomm Snapdragon firmware issue across Snapdragon Auto, Compute, Connectivity, Industrial IOT, and Mobile. Root cause: an out-of-bounds read in FIPS event processing caused by improper validation of the firmware length. Impact stated in the CVE: availability impact ...

CVE-2021-35121

CVE-2021-35121 affects Qualcomm/Snapdragon kernel components, specifically the Synx driver, where an array index is improperly used to lock/unlock a mutex. This leads to a Use-After-Free condition that can be triggered locally, with the CVSS v3.1 vector indicating Local access, Low attack complex...

CVE-2022-22082

CVE-2022-22082 affects Qualcomm Snapdragon families (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). The vulnerability is due to memory corruption caused by a possible buffer overflow while parsing the DSF header with a corrupted channel count, leadin...

CVE-2022-22087

CVE-2022-22087 is a memory corruption/buffer overflow issue in the video parsing path for MKV clips on Qualcomm Snapdragon platforms (Auto/Compute/Connectivity/IoT/Wearables). The root cause is described as a boundary/overflow condition when parsing MKV clips, leading to memory corruption. Affect...

CVE-2021-30345

CVE-2021-30345 describes an improper SMMU configuration in Qualcomm RPM secure Stream that can allow access to any secure resource. The initial entry lists affected Qualcomm Snapdragon lines (Industrial IOT, Mobile, Wearables, Wired Infrastructure and Networking) and notes the root cause as a mis...

CVE-2022-22083

CVE-2022-22083 describes a denial-of-service caused by memory corruption when extracting the ape header from clips in Qualcomm Snapdragon platforms. Affected components include Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. The availabl...

CVE-2022-22084

CVE-2022-22084: Memory corruption occurs when extracting qcp audio files due to a missing data-length check in Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Affected are Qualcomm Snapdragon environments; root cause is...

CVE-2021-35084

CVE-2021-35084 involves a possible out-of-bounds read due to lack of length check on the data length for a DIAG event in Qualcomm Snapdragon products (Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music). Affected components are Snap...

CVE-2021-35120

CVE-2021-35120 affects Qualcomm Snapdragon components (Compute, Connectivity, Industrial IOT, Mobile). Root cause: improper handling between export and release functions on the same client handle, causing a use-after-free. Impact is partial to high (per CVSS) with local attack, no user interactio...

CVE-2022-33248

CVE-2022-33248: Memory corruption in Qualcomm's User Identity Module caused by an integer overflow leading to a buffer overflow when a segment is received via qmi http. Affected: Qualcomm chip components with a local attack vector and high impact (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; b...

CVE-2021-30339

CVE-2021-30339 involves reading PRNG output with insufficient buffer validation, leading to improper key generation in Qualcomm chipsets. The initial entry lists affected Qualcomm Snapdragon families: Connectivity, Industrial IoT, Mobile, Wearables, and Wired Infrastructure and Networking. Public...

CVE-2022-22059

CVE-2022-22059 describes a memory corruption due to an out-of-bounds read when parsing a video file in Qualcomm Snapdragon components. Affected products include Snapdragon Auto, Compute, Connectivity, Industrial IOT, and Mobile. The issue is documented with a CVSS base score of 7.8 (Initial), and...

CVE-2021-35085

CVE-2021-35085 describes a buffer overflow in Qualcomm Snapdragon family (Auto, Compute, Connectivity, Industrial IOT, Mobile) caused by missing buffer-length checks during management-frame Rx. Affected components are Qualcomm Snapdragon products listed; root cause is insufficient validation of i...

CVE-2022-40510

The CVE-2022-40510 issue affects Qualcomm closed-source audio components during EVS-based voice calls. Root cause: memory corruption from a buffer copy that does not validate input size when processing audio. Impact, as stated: high confidentiality, integrity, and availability implications with n...

CVE-2022-40514

CVE-2022-40514 concerns memory corruption in WLAN firmware when processing the CCKM IE in a reassoc response frame, caused by a buffer copy that does not validate input size. The vulnerability is associated with Qualcomm’s WLAN firmware; CVSS v3.1 base score is PRACTICALLY high: 9.8 (Network atta...

CVE-2021-35092

CVE-2021-35092 concerns Qualcomm Snapdragon modem components. The issue arises from processing the DCB/AVB algorithm with an invalid queue index in an IOCTL request, which could lead to arbitrary address modification on affected Snapdragon products (e.g., Snapdragon Auto, Compute, Connectivity, C...

CVE-2021-35098

CVE-2021-35098 describes memory corruption due to improper validation of the session id in the PCM routing process across Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The issue, as documented by NVD and Red Hat, has ...

CVE-2021-30350

CVE-2021-30350 describes a memory-corruption vulnerability caused by lack of MBN header size verification against input buffers in Qualcomm Snapdragon family components (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Wearables). The issue affects Qualcomm closed-source components and ...

CVE-2023-21652

CVE-2023-21652 describes a cryptographic issue in HLOS where derived keys used to encrypt/decrypt information remain on the stack after use. The vulnerability is noted across multiple sources (e.g., Red Hat, NVD, PRION/Vuln enrichment) with the CVSS v3.1 base metrics indicating HIGH impact for co...

CVE-2022-40512

CVE-2022-40512 describes a transient DoS in WLAN firmware caused by a buffer over-read while processing probe responses or beacons. The vulnerability affects Qualcomm WLAN firmware/module (closed-source components) and is characterized by network-based exposure with no user interaction. The CVSS ...

CVE-2021-30281

CVE-2021-30281 concerns an access control error described for Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Voice & Music, Wearables, Wired Infrastructure & Networking). Description states possible unauthorized access to a secure space due to improper c...

CVE-2021-30344

CVE-2021-30344 involves improper authorization of a replayed LTE security mode command that can cause a denial of service in Qualcomm Snapdragon devices. The vulnerability is described under Qualcomm closed-source components; public details on affected products, versions, or a concrete fix are no...

CVE-2022-33233

CVE-2022-33233 affects Qualcomm modem (closed-source components) and is described as memory corruption caused by a configuration weakness when sending commands to write to protected files. The vulnerability is localized (LOCAL) with low privileges required and no user interaction, and is rated HI...

CVE-2021-30341

CVE-2021-30341 describes memory corruption caused by improper buffer size validation of DSM packets in Qualcomm/Snapdragon components (Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Wearables). The CVSS v3.1 base score is 9.8 (CRITICAL) with NETWORK ...

CVE-2021-35118

CVE-2021-35118 concerns a boundary error in the Qualcomm Snapdragon camera driver that can cause an out-of-bounds write due to an incorrect input check. Affected components listed across Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Wearables and related camera subsystem...

CVE-2022-40531

CVE-2022-40531: Memory corruption in WLAN due to an incorrect type cast when sending WMI_SCAN_SCH_PRIO_TBL_CMDID. Documented CVSSv3.1 base score 7.8 (NVD) / 8.4 (Qualcomm bulletin) with Local, Low-Privilege, No-User-Interaction access and High impact to confidentiality, integrity, and availabilit...

CVE-2021-35078

CVE-2021-35078 describes a potential memory leak caused by improper validation of the certificate chain length while parsing the server certificate chain in Qualcomm Snapdragon families (Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Wearables). Connected sources (P...

CVE-2021-35116

The CVE-2021-35116 issue affects Qualcomm Snapdragon devices (Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables) and is triggered when an APK loads a crafted model into the CDSP, potentially compromising the CDSP and other APKs’ data executing there. This is the stated impact...

CVE-2022-22086

CVE-2022-22086 is a memory corruption issue due to a double free while parsing a 3gp clip with invalid meta data atoms in Qualcomm Snapdragon components (Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables). Affected are Qualcomm Snapdragon products; the root caus...

CVE-2022-25657

CVE-2022-25657 is a memory-corruption issue caused by a buffer overflow when processing an invalid MKV clip with an invalid seek header. The vulnerability is described across multiple sources as affecting Qualcomm Snapdragon family components: Auto, Compute, Connectivity, Industrial IOT, Mobile, ...