qualcomm has 100 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 35 in the last 90 days against 10 in the 90 before. The busiest recent month was January 2026 with 22. The median CVSS is 7.8 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-126 (23) and CWE-416 (16). Most affected products: cologne_firmware (12), fastconnect_6200_firmware (9), fastconnect_6700_firmware (9).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 35 prev 10
Weakness classes
Products
- cologne_firmware 12
- fastconnect_6200_firmware 9
- fastconnect_6700_firmware 9
- fastconnect_6900_firmware 9
- snapdragon_g1_gen_2_gaming_platform_firmware 6
- ar8035_firmware 4
Worst active — by depth score
CVE-2026-25254Critical· 9.8Improper authorization leads to Remote Code Execution via SocketIO interface.54CVE-2026-25262Medium· 6.9Memory corruption while processing a crafted ELF file in the Primary Bootloader.50CVE-2026-25265High· 8.8Privilege escalation due to weak configuration while temporary file handling.48CVE-2026-25264High· 8.8Privilege escalation due to weak configuration during package extraction process.48CVE-2026-25255High· 8.8Exposed dangerous function lead to privilege escalation via gRPC server.48
qualcomm vulnerabilities
CVEs affecting qualcomm, newest first. Open any entry for full detail, references, and exploit status.
100 CVEsRSS
CVE-2026-57559High· 7.8Memory corruption while processing service requests.
Memory corruption while processing service requests.
CVE-2026-57555High· 7.8Memory Corruption when executing system service routines due to improper handling of user input buffers.
Memory Corruption when executing system service routines due to improper handling of user input buffers.
CVE-2026-57554High· 7.8Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-57546High· 7.5Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
CVE-2026-57545High· 7.8Memory corruption when processing draw objects of incorrect type during graphics command list execution.
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
CVE-2026-57537High· 7.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
CVE-2026-25302High· 7.1Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
CVE-2026-25291High· 7.8Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVE-2026-25274Medium· 6.7Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
CVE-2026-25273Medium· 6.7Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
CVE-2026-25272Medium· 6.7Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
CVE-2026-25270Medium· 6.7Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
CVE-2026-25269Medium· 6.7Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
CVE-2026-25267High· 7.8Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVE-2026-25263Medium· 6.6Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVE-2026-25262Medium· 6.9PoCMemory corruption while processing a crafted ELF file in the Primary Bootloader.
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
CVE-2026-25255High· 8.8Exposed dangerous function lead to privilege escalation via gRPC server.
Exposed dangerous function lead to privilege escalation via gRPC server.
CVE-2026-25254Critical· 9.8Improper authorization leads to Remote Code Execution via SocketIO interface.
Improper authorization leads to Remote Code Execution via SocketIO interface.
CVE-2026-25265High· 8.8Privilege escalation due to weak configuration while temporary file handling.
Privilege escalation due to weak configuration while temporary file handling.
CVE-2026-25264High· 8.8Privilege escalation due to weak configuration during package extraction process.
Privilege escalation due to weak configuration during package extraction process.
CVE-2026-24073High· 7.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
CVE-2026-24081High· 7.4Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
CVE-2026-24075High· 7.8Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
CVE-2026-24074High· 7.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
CVE-2026-25261Medium· 6.7Memory corruption while processing rear sensor IOCTL calls.
Memory corruption while processing rear sensor IOCTL calls.
CVE-2025-59607High· 7.8Memory Corruption when copying large input data exceeds normal allocation limits.
Memory Corruption when copying large input data exceeds normal allocation limits.
CVE-2026-25281High· 7.4Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
CVE-2026-25275High· 7.5Transient DOS when processing authentication frames with invalid FILS information element header lengths.
Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-25282High· 7.9Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
CVE-2026-25278High· 7.8Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.