Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2025-27071HIGHBuffer Copy Without Checking Size of Input in Powerline Communication FirmwareEPSS 0.2%CVE-2020-3644—u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display session' in SnapdragoEPSS 0.2%CVE-2018-13914—Lack of input validation for data received from user space can lead to an out of bound array issue in Snapdragon Auto, Snapdragon Consumer IEPSS 0.2%CVE-2020-3666—u'Out of bounds memory access during memory copy while processing Host command' in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivEPSS 0.2%CVE-2018-11878—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory acEPSS 0.2%CVE-2018-11927—Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from fEPSS 0.2%CVE-2019-2326—Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, EPSS 0.2%CVE-2018-5884—Improper Access Control in Multimedia in Snapdragon Mobile and Snapdragon Wear, Non-standard applications without permission may acquire perEPSS 0.2%CVE-2020-11130—u'Possible buffer overflow in WIFI hal process due to copying data without checking the buffer length' in Snapdragon Auto, Snapdragon ComputEPSS 0.2%CVE-2019-14065—u'Pointer double free in HavenSvc due to not setting the pointer to NULL after freeing it' in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2018-13920—Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon EPSS 0.2%CVE-2020-3646—u'Buffer overflow seen as the destination buffer size is lesser than the source buffer size in video application' in Snapdragon Compute, SnaEPSS 0.2%CVE-2019-14115—u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result EPSS 0.2%CVE-2019-2308—User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subEPSS 0.2%CVE-2018-13899—Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, EPSS 0.2%CVE-2018-5830—While processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message, a buffer overflow can potentially occur in Android releases from CAF using EPSS 0.2%CVE-2026-21367HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2020-11183—A process can potentially cause a buffer overflow in the display service allowing privilege escalation by executing code as that service in EPSS 0.2%CVE-2020-11181—Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in SnapEPSS 0.2%CVE-2018-13919—Use-after-free vulnerability will occur if reset of the routing table encounters an invalid rule id while processing command to reset in SnaEPSS 0.2%