CVE-2021-1905

CVE-2021-1905 is a memory-management vulnerability (use-after-free) in Qualcomm Snapdragon chipsets caused by improper handling of memory mapping across multiple processes. Affects a broad range of Snapdragon products (Auto, Compute, Connectivity, IoT, Mobile, Wearables, etc.). The CVE is charact...

CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2022-40503

CVE-2022-40503 is a buffer over-read vulnerability in the Bluetooth Host during A2DP streaming, described as information disclosure. It affects Qualcomm components (Bluetooth) and is referenced in Qualcomm security bulletins; public details appear in NVD and Red Hat/CVE cross references. Remediat...

CVE-2023-33063

CVE-2023-33063 is a Use-After-Free/memory corruption issue in Qualcomm DSP Services triggered by a remote call from HLOS to DSP. Affected: Qualcomm chipsets with DSP Services; root cause: memory corruption leading to potential unintended behavior. Documents indicate high impact (confidentiality, ...

CVE-2023-33107

CVE-2023-33107 is an integer overflow/memory-corruption vulnerability in Graphics Linux affecting Qualcomm display components. The flaw occurs when assigning a shared virtual memory region during an IOCTL, enabling local attacker access with low complexity and no user interaction; impact is rated...

CVE-2022-33298

CVE-2022-33298 corresponds to a memory corruption issue caused by a use-after-free in the Modem during modem initialization. Multiple connected sources reference a Modem-related vulnerability with memory corruption as the impact; however, the provided documents do not specify affected models, fir...

CVE-2022-22065

CVE-2022-22065 is a Qualcomm Snapdragon WLAN-Host vulnerability characterized by an out-of-bounds read due to an improper length check, leading to Denial of Service. The CVE is listed under Qualcomm components for the May 2022 Android security updates as a High-severity WLAN issue. Connected sour...

CVE-2021-1931

CVE-2021-1931 is a buffer overflow in Qualcomm SDM660 bootloader processing of fastboot/flash data. The exploit arose from improper handling of large payloads in the bootloader’s flash: command, enabling memory corruption that could bypass signature checks and unlock the bootloader on SDM660 devi...

CVE-2022-22072

CVE-2022-22072 is a buffer overflow caused by improper validation of NDP application information length in Qualcomm Snapdragon family components (including Auto, Compute, CE Connectivity, CIOT, Industrial IOT, Mobile, Voice & Music) and related WLAN subsystems. The vulnerability is locally exploi...

CVE-2024-23380

CVE-2024-23380 is a memory corruption issue in Qualcomm’s graphics stack related to handling user packets during a VBO bind operation. The flaw is described as a local issue with high impact to confidentiality, integrity, and availability. The CVSS indicates local access with low attack complexit...

CVE-2022-22088

CVE-2022-22088 is a memory corruption vulnerability in the Qualcomm Bluetooth HOST component caused by a buffer overflow while parsing a remote command response. Reported in the Qualcomm January 2023 Security Bulletin, the issue affects devices using certain Qualcomm chipsets and has a CVSS of 9....

CVE-2020-11239

CVE-2020-11239 describes a use-after-free when importing a DMA buffer using the CPU address due to an attachment not being cleaned up. Affected are Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root caus...

CVE-2022-33243

The CVE-2022-33243 entry describes memory corruption due to improper access control in Qualcomm IPC. Public records in this set identify Qualcomm IPC as the affected component and characterize the vulnerability as memory corruption arising from access-control weaknesses, with high impact on confi...

CVE-2023-21656

CVE-2023-21656 is a memory corruption issue in the WLAN HOST when receiving a WMI event from firmware, affecting Qualcomm chipsets (WLAN component). The primary sources list the vulnerability and its high impact (CVSS 3.1: AV=L/AC=L/PR=L/UI:N/S:U/C:H/I:H/A:H) but do not provide concrete product v...

CVE-2024-23373

CVE-2024-23373 is a memory corruption/Use-After-Free issue in Qualcomm graphics stack related to IOMMU unmap handling, where a failed unmap can cause DMA/anonymous buffers to be released. Public sources assign a HIGH impact with local attack requirements (no user interaction). The CVE is document...

CVE-2023-21657

CVE-2023-21657 describes memory corruption in Qualcomm Audio when the ADSP receives input during a recording use case. Affected component: Qualcomm audio stack (Audio/ADSP). Root cause: memory corruption in the audio path during input handling in record mode. Impact: high across confidentiality, ...

CVE-2023-21665

CVE-2023-21665 describes memory corruption in the Qualcomm Adreno KGSL graphics driver. The connected packetstorm entry details an unchecked cast of vma->vm_file->private_data in kgsl_setup_dmabuf_useraddr(), which is reachable via IOCTL_KGSL_MAP_USER_MEM and can bypass sanity checks on VMA...

CVE-2023-21666

CVE-2023-21666 refers to memory corruption in graphics when accessing a buffer allocated through the graphics pool, tied to Qualcomm Adreno KGSL. The PacketStorm article documents a vulnerability class where, on KGSL builds without CONFIG_QCOM_KGSL_USE_SHMEM (or older KGSL versions without it), G...

CVE-2021-1945

CVE-2021-1945 describes a possible out-of-bounds read in Qualcomm Snapdragon firmware, caused by a missing length check for the Bandwidth-NSS IE across multiple Snapdragon lines (Auto/Compute/Connectivity/IoT/Industrial IoT/Mobile/Voice & Music/ Wired Infrastructure). The vulnerability affects Qu...

CVE-2022-25743

CVE-2022-25743 is a memory corruption via use-after-free in KGSL during graphics buffer import on Qualcomm Snapdragon GPUs (multiple Snapdragon lines). Affected component is graphics driver; root cause is use-after-free leading to potential memory corruption with high impact. CVSS vectors indicat...

CVE-2022-33213

CVE-2022-33213 refers to a memory corruption in a Qualcomm closed‑source modem component triggered by a buffer overflow while processing a PPP packet. Affected asset class: Qualcomm modem (closed‑source) within Snapdragon devices; underlying cause: memory corruption due to buffer overflow; potent...

CVE-2022-33255

CVE-2022-33255 is a buffer over-read information-disclosure issue in the Bluetooth HOST when processing GetFolderItems and GetItemAttribute Cmds from a peer device. The CVE is listed in Qualcomm’s security bulletin with a High severity for Bluetooth, and is described as a information-disclosure v...

CVE-2022-33280

CVE-2022-33280 describes a memory corruption in the Bluetooth HOST when processing AVRCP packets due to an uninitialized pointer. The issue is attributed to Qualcomm components (Bluetooth) and is listed across multiple feeds (NVD, Red Hat, CVE.org, CNNVD, etc.) as a memory corruption vulnerabilit...

CVE-2021-1943

CVE-2021-1943 describes a buffer out-of-bounds read due to improper TBTT count/length validation when parsing beacon responses in Qualcomm Snapdragon WLAN components across Snapdragon Auto, Compute, Connectivity, Industrial IOT, Mobile, and Wired Infrastructure and Networking. The vulnerability d...

CVE-2021-1907

CVE-2021-1907 is a buffer overflow vulnerability caused by a missing length check in BA requests in Qualcomm Snapdragon platforms (Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile). The issue affects Qualcomm‑based Snapdragon components and is described in Qualcomm’s July 2...

CVE-2021-1955

CVE-2021-1955 describes a Denial of Service in Qualcomm’s Snapdragon stack caused by improper handling of connections when an association is rejected. The issue affects Snapdragon Auto/Compute/Connectivity and related Snapdragon lines (IoT, Wearables, Mobile, etc.). Root cause: mishandling of con...

CVE-2022-22075

CVE-2022-22075 concerns Information Disclosure in Graphics during GPU context switch, with affected component listed as Qualcomm Display. The CVE is documented in multiple sources, including NVD and Qualcomm security references, indicating a vulnerability in the graphics/GPU context switch pathwa...

CVE-2022-40537

CVE-2022-40537 is a memory corruption issue in the Bluetooth HOST when handling the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response. The connected sources identify this as affecting Qualcomm Bluetooth components (e.g., Snapdragon) and classify the issue under Bluetooth with a high/critical impa...

CVE-2021-1964

CVE-2021-1964 corresponds to a buffer over-read in Qualcomm WLAN/IEEE 802.11 beacon parsing due to improper validation of IE size in the WLAN host subsystem. Affected are Qualcomm Snapdragon/WLAN components (e.g., QCA6574AU and related chips) across multiple Snapdragon device families. Root cause...

CVE-2021-1970

CVE-2021-1970 relates to an out-of-bounds read in Qualcomm WLAN/Qualcomm Snapdragon subsystems caused by insufficient length checks for FT sub-elements. Affected products include Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music lineages and WLAN components. Th...

CVE-2023-33059

Mode C: CVE-2023-33059 concerns memory corruption in the Audio component when processing VOC packet data from ADSP, affecting Qualcomm audio/ADSP stacks. Root cause cited across connected sources as a buffer/memory handling issue in VOC packet processing with high impact on confidentiality, integ...

CVE-2023-33120

CVE-2023-33120 affects Qualcomm ADSP Audio: memory corruption occurs when a memory map command is executed consecutively. This is described across multiple sources (NVD/Red Hat/RH advisories) as a memory corruption in Audio due to repeated memory-mapping commands. The CVSS-based description in th...

CVE-2022-22085

CVE-2022-22085 corresponds to memory corruption in the video subsystem due to a buffer overflow when reading the DTS file on Qualcomm Snapdragon family devices (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root cause is a buffer over...

CVE-2023-33021

CVE-2023-33021 describes a memory corruption (use-after-free) in the Graphics path when processing user packets for command submission, affecting Qualcomm Snapdragon graphics components. Impact is high for confidentiality, integrity, and availability per the NVD metrics. Connected sources corrobo...

CVE-2024-21468

CVE-2024-21468 corresponds to a memory corruption issue that occurs when a GPU unmap operation fails, described across multiple sources as a memory corruption/Use-After-Free condition in Qualcomm kernel components. Affected: Qualcomm chipset GPUs and related kernel code paths. Root cause: failed ...

CVE-2022-22058

CVE-2022-22058 describes a memory corruption due to a use-after-free in the kernel when handling ION handles, impacting Qualcomm Snapdragon-based devices (e.g., Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearable...

CVE-2020-11309

The CVE-2020-11309 issue is a Use-After-Free in Qualcomm Adreno GPU drivers related to mapping user memory to GPU memory, caused by an improper check of referenced memory in Snapdragon GPUs. The vulnerability affects Qualcomm GPU components integrated in Snapdragon devices (Auto/Compute/Connectiv...

CVE-2023-24851

CVE-2023-24851 is a memory corruption vulnerability in the WLAN HOST component when parsing a QMI response from firmware. It is listed for Qualcomm WLAN and appears in Qualcomm’s July 2023 bulletin; CVSS v3.1 base score 7.8 (LOCAL, LOW attack complexity, HIGH impact on confidentiality, integrity,...

CVE-2023-33064

CVE-2023-33064 is described as a Transient DoS in Audio when invoking the callback function of the ASM driver (Qualcomm chipsets). The vulnerability affects the Audio component via the ASM driver callback path and has a CVSS 3.1 base score of 5.5 (Local, Low Privileges, Low Auth, High Impact on A...

CVE-2020-11262

CVE-2020-11262 describes a race between command submission and context destruction that can cause an invalid context to be added, leading to a use-after-free condition. Reported for Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables (Qualcomm/Snapdrago...

CVE-2020-11308

CVE-2020-11308 describes a buffer overflow in Qualcomm Snapdragon components (e.g., Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music and related bootloader) triggered while converting ASCII strings to Unicode when the actual size exceeds the required size. Pub...

CVE-2023-33092

CVE-2023-33092 describes a memory corruption in the Bluetooth HOST path when processing a pin reply whose value from the APP layer exceeds the expected size. The issue is caused by a buffer copy without adequate input-size checks. Reported impact in sources indicates high/severe consequences with...

CVE-2024-53027

CVE-2024-53027 is a transient DoS vulnerability triggered while processing a malformed Country Information Element in Qualcomm WLAN firmware and Bluetooth stacks. Exploitation requires proximity (remote over Wi‑Fi/Bluetooth) and can crash the chipset firmware, potentially disrupting connectivity ...

CVE-2022-25724

CVE-2022-25724 describes a memory corruption issue caused by a buffer overflow while validating the user address in Qualcomm Snapdragon graphics stack, affecting Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. The publicly documented imp...

CVE-2023-28588

CVE-2023-28588 (Qualcomm Bluetooth) : A transient DoS in the Bluetooth Host during RFC slot allocation affects Qualcomm Chipsets’ Bluetooth component. Public records describe an integer overflow/wraparound issue in the Bluetooth Host as the root cause. The CVSSv3.1 base score is 7.5 (High) with n...

CVE-2021-1976

CVE-2021-1976 is a Qualcomm WLAN use-after-free vulnerability caused by improper validation of a P2P device address in PD Request frames. It affects Qualcomm/ Snapdragon WLAN components; exploited via network, with a CVSS v3.1 base score of 9.8 (CRITICAL). Public details reference Qualcomm’s Augu...

CVE-2022-25720

CVE-2022-25720 describes a memory corruption vulnerability in Qualcomm WLAN firmware affecting Snapdragon lines (Auto/Compute/Connectivity/Consumer Electronics Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables). The issue stems from out-of-bounds array access during connect/...

CVE-2024-33060

CVE-2024-33060 is a use-after-free race in Qualcomm’s DSP/adsprpc driver (fastrpc_mmap) that can occur when global and local mappings are concurrently created and freed. The vulnerability centers on fastrpc_mmap_create, fastrpc_mmap_add, and related epilogue paths (mem_map_to_dsp, munmap/mmap_fre...

CVE-2024-23368

CVE-2024-23368 is a memory corruption issue in Qualcomm’s embedded platform concerning the SMEM Partition Handler. The vulnerability arises when allocating and accessing an entry in an SMEM partition, effectively a classic buffer copy without proper input size checking, which can lead to memory c...