Vulnerabilities in Qualcomm, Inc.

2,976 results
Vexday analysis

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2019-10623—Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in EPSS 0.2%CVE-2019-14101—Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected EPSS 0.2%CVE-2019-14053—When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to EPSS 0.2%CVE-2019-14039—Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon CEPSS 0.2%CVE-2025-47324HIGHExposure of Sensitive Information Through Metadata in Powerline Communication FirmwareEPSS 0.2%CVE-2019-14042—Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, SnEPSS 0.2%CVE-2023-21629MEDIUMDouble Free in ModemEPSS 0.2%CVE-2019-10545—Null pointer dereference issue in kernel due to missing check related to LLC support in GPU in Snapdragon Auto, Snapdragon Consumer ElectronEPSS 0.2%CVE-2019-10513—Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon Auto, Snapdragon ComEPSS 0.2%CVE-2021-1940HIGHUse after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,EPSS 0.2%CVE-2019-14075—Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon ConEPSS 0.2%CVE-2019-10616—Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto, Snapdragon Compute, EPSS 0.2%CVE-2017-18330—Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile and snapdragon wear EPSS 0.2%CVE-2017-18312—While accessing SafeSwitch services, third party can manipulate a given device and perform unauthorized operation due to lack of checking ofEPSS 0.2%CVE-2020-11306HIGHPossible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, SnapdragEPSS 0.2%CVE-2018-13889—In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Heap memory was accessed after itEPSS 0.2%CVE-2020-11267HIGHStack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, EPSS 0.2%CVE-2018-11962—In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Use-after-free issue in heap whilEPSS 0.2%CVE-2020-11186—Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in SnapdrEPSS 0.2%CVE-2020-11304HIGHPossible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapEPSS 0.2%