qualcomm has 105 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 35 in the last 90 days against 3 in the 90 before. The busiest recent month was January 2026 with 22. The median CVSS is 7.8 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-126 (24) and CWE-416 (18). Most affected products: cologne_firmware (12), fastconnect_6200_firmware (9), fastconnect_6700_firmware (9).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 35 prev 3
Weakness classes
Products
- cologne_firmware 12
- fastconnect_6200_firmware 9
- fastconnect_6700_firmware 9
- fastconnect_6900_firmware 9
- snapdragon_g1_gen_2_gaming_platform_firmware 6
- Snapdragon 4
Worst active — by depth score
CVE-2026-25254Critical· 9.8Improper authorization leads to Remote Code Execution via SocketIO interface.54CVE-2026-25262Medium· 6.9Memory corruption while processing a crafted ELF file in the Primary Bootloader.50CVE-2026-25265High· 8.8Privilege escalation due to weak configuration while temporary file handling.48CVE-2026-25264High· 8.8Privilege escalation due to weak configuration during package extraction process.48CVE-2026-25255High· 8.8Exposed dangerous function lead to privilege escalation via gRPC server.48
qualcomm vulnerabilities
CVEs affecting qualcomm, newest first. Open any entry for full detail, references, and exploit status.
105 CVEsRSS
CVE-2025-27040Medium· 6.5Information disclosure may occur while processing the hypervisor log.
Information disclosure may occur while processing the hypervisor log.
CVE-2025-27039Medium· 6.6Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
CVE-2025-27059High· 8.8Memory corruption while performing SCM call.
Memory corruption while performing SCM call.
CVE-2025-27036Medium· 6.1Information disclosure when Video engine escape input data is less than expected minimum size.
Information disclosure when Video engine escape input data is less than expected minimum size.
CVE-2025-27033Medium· 6.1Information disclosure while running video usecase having rogue firmware.
Information disclosure while running video usecase having rogue firmware.
CVE-2025-27030Medium· 6.1information disclosure while invoking calibration data from user space to update firmware size.
information disclosure while invoking calibration data from user space to update firmware size.
CVE-2025-21488High· 8.2Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
CVE-2025-21487High· 8.2Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
CVE-2025-21484High· 8.2Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
CVE-2025-21482High· 7.1Cryptographic issue while performing RSA PKCS padding decoding.
Cryptographic issue while performing RSA PKCS padding decoding.
CVE-2025-21473High· 7.8Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux
Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.
CVE-2025-21461High· 7.8Out-of-bounds Write in Camera_Linux
Memory corruption when programming registers through virtual CDM.
CVE-2025-21456High· 7.8Use After Free in NPU
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
CVE-2025-21428High· 7.5Buffer Over-read in WLAN Host
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
CVE-2024-23384High· 8.4Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.