qualcomm has 105 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 35 in the last 90 days against 3 in the 90 before. The busiest recent month was January 2026 with 22. The median CVSS is 7.8 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-126 (24) and CWE-416 (18). Most affected products: cologne_firmware (12), fastconnect_6200_firmware (9), fastconnect_6700_firmware (9).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 35 prev 3
Weakness classes
Products
- cologne_firmware 12
- fastconnect_6200_firmware 9
- fastconnect_6700_firmware 9
- fastconnect_6900_firmware 9
- snapdragon_g1_gen_2_gaming_platform_firmware 6
- Snapdragon 4
Worst active — by depth score
CVE-2026-25254Critical· 9.8Improper authorization leads to Remote Code Execution via SocketIO interface.54CVE-2026-25262Medium· 6.9Memory corruption while processing a crafted ELF file in the Primary Bootloader.50CVE-2026-25265High· 8.8Privilege escalation due to weak configuration while temporary file handling.48CVE-2026-25264High· 8.8Privilege escalation due to weak configuration during package extraction process.48CVE-2026-25255High· 8.8Exposed dangerous function lead to privilege escalation via gRPC server.48
qualcomm vulnerabilities
CVEs affecting qualcomm, newest first. Open any entry for full detail, references, and exploit status.
105 CVEsRSS
CVE-2026-25290High· 7.8Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
CVE-2026-25284High· 7.3Information Disclosure when a pointer is reused after being deallocated.
Information Disclosure when a pointer is reused after being deallocated.
CVE-2026-25283High· 8.8Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
CVE-2026-25294High· 7.4Transient DOS while parsing frame during channel usage.
Transient DOS while parsing frame during channel usage.
CVE-2026-25280High· 7.8Memory corruption when processing escape handling flow with insufficient user buffer sizes.
Memory corruption when processing escape handling flow with insufficient user buffer sizes.
CVE-2025-59617Medium· 6.6Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.
CVE-2025-59616Medium· 6.6Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.
CVE-2025-59615Medium· 6.6Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.
Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.
CVE-2025-47408High· 7.8Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
CVE-2025-47407High· 7.8Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
CVE-2025-47406Medium· 6.1Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
CVE-2025-47405High· 7.8Memory corruption when processing camera sensor input/output control codes with invalid output buffers.
Memory corruption when processing camera sensor input/output control codes with invalid output buffers.
CVE-2025-47404Medium· 6.5Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
CVE-2025-47403Medium· 6.5Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
CVE-2025-47401Medium· 6.5Transient DOS when processing target power rate tables during channel configuration.
Transient DOS when processing target power rate tables during channel configuration.
CVE-2025-47400High· 7.1Cryptographic issue while copying data to a destination buffer without validating its size.
Cryptographic issue while copying data to a destination buffer without validating its size.
CVE-2025-47392High· 8.8Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
CVE-2025-47391High· 7.8Memory corruption while processing a frame request from user.
Memory corruption while processing a frame request from user.
CVE-2025-47390High· 7.8Memory corruption while preprocessing IOCTL request in JPEG driver.
Memory corruption while preprocessing IOCTL request in JPEG driver.
CVE-2025-47389High· 7.8Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
CVE-2025-47374Medium· 6.5Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.
Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.
CVE-2025-47339High· 7.8Memory corruption while deinitializing a HDCP session.
Memory corruption while deinitializing a HDCP session.
CVE-2025-47396High· 7.8Memory corruption occurs when a secure application is launched on a device with insufficient memory.
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
CVE-2025-47395Medium· 6.5Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
CVE-2025-47394High· 7.8Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
CVE-2025-47393High· 7.8Memory corruption when accessing resources in kernel driver.
Memory corruption when accessing resources in kernel driver.
CVE-2025-47388High· 7.8Memory corruption while passing pages to DSP with an unaligned starting address.
Memory corruption while passing pages to DSP with an unaligned starting address.
CVE-2025-47380High· 7.8Memory corruption while preprocessing IOCTLs in sensors.
Memory corruption while preprocessing IOCTLs in sensors.
CVE-2025-47369Medium· 5.5Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
CVE-2025-47356High· 7.8Memory Corruption when multiple threads concurrently access and modify shared resources.
Memory Corruption when multiple threads concurrently access and modify shared resources.