Vulnerabilidades em Qualcomm, Inc.

2.976 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2017-18311—XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration portEPSS 0.2%CVE-2018-11830—Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics ConnectivEPSS 0.2%CVE-2020-11148—Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggEPSS 0.2%CVE-2018-11857—Improper input validation in WLAN encrypt/decrypt module can lead to a buffer copy in Snapdragon Mobile in version SD 835, SD 845, SD 850EPSS 0.2%CVE-2020-11149—Out of bound access due to usage of an out-of-range pointer offset in the camera driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon EPSS 0.2%CVE-2018-3588—There is improper access control of the SSC and GPU mapped regions which lead to inject code from HLOS in Snapdragon Automobile, Snapdragon EPSS 0.2%CVE-2018-11858—When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version EPSS 0.2%CVE-2025-27073HIGHReachable Assertion in WLAN FirmwareEPSS 0.2%CVE-2025-21452HIGHReachable Assertion in ModemEPSS 0.2%CVE-2025-27065HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2020-3676—Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, SnapdragoEPSS 0.2%CVE-2019-2261—Unauthorized access from GPU subsystem to HLOS or other non secure subsystem memory can lead to information disclosure in Snapdragon Auto, SEPSS 0.2%CVE-2025-21477HIGHImproper Input Validation in ModemEPSS 0.2%CVE-2018-5835—If the seq_len is greater then CSR_MAX_RSC_LEN, a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android EPSS 0.2%CVE-2025-47318HIGHBuffer Over-read in BT ControllerEPSS 0.2%CVE-2019-10621—Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, EPSS 0.2%CVE-2020-11146—Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon Auto, Snapdragon CompEPSS 0.2%CVE-2018-11824—A stack-based buffer overflow can occur in a firmware routine in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SDEPSS 0.2%CVE-2018-11928—Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, SnapdragonEPSS 0.2%CVE-2018-11855—If an end user makes use of SCP11 sample OCE code without modification it could lead to a buffer overflow when transmitting a CAPDU in SnapdEPSS 0.2%