Vulnerabilidades em Qualcomm, Inc.

2.976 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2026-25275HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2020-3643—u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, SnapEPSS 0.2%CVE-2019-2333—Buffer overflow due to improper validation of buffer size while IPA driver processing to perform read operation in Snapdragon Auto, SnapdragEPSS 0.2%CVE-2019-2341—Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. in Snapdragon Auto, SnapEPSS 0.2%CVE-2018-5858—In the audio debugfs in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before securEPSS 0.2%CVE-2019-10530—Lack of check of data truncation on user supplied data in kernel leads to buffer overflow in Snapdragon Auto, Snapdragon Consumer IOT, SnapdEPSS 0.2%CVE-2018-11274—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when pEPSS 0.2%CVE-2018-11275—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastboEPSS 0.2%CVE-2018-5889—While processing a compressed kernel image, a buffer overflow can occur in Android releases from CAF using the linux kernel (Android for MSMEPSS 0.2%CVE-2020-3610—Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount EPSS 0.2%CVE-2020-3622—u'Channel name string which has been read from shared memory is potentially subjected to string manipulations but not validated for NULL terEPSS 0.2%CVE-2019-2295—Information disclosure due to lack of address range check done on the SysDBG buffers in SDI code. in Snapdragon Auto, Snapdragon Compute, SnEPSS 0.2%CVE-2019-10608—Information disclosure issue occurs as there is no binding between the secure keypad session and the secure display session that allows userEPSS 0.2%CVE-2018-3567—In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security pEPSS 0.2%CVE-2020-11133—u'Possible out of bound array write in rxdco cal utility due to lack of array bound check' in Snapdragon Compute, Snapdragon Consumer IOT, SEPSS 0.2%CVE-2020-3648—u'Possible out of bound write in DSP driver code due to lack of check of data received from user' in Snapdragon Auto, Snapdragon Compute, SnEPSS 0.2%CVE-2019-2236—Null pointer dereference during secure application termination using specific application ids. in Snapdragon Auto, Snapdragon Compute, SnapdEPSS 0.2%CVE-2020-11174—u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, SnapdragonEPSS 0.2%CVE-2020-11125—u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Snapdragon AuEPSS 0.2%CVE-2019-2338—Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in EPSS 0.2%