Srv1l Firmware
by Qualcomm
CVEs (163)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-21481 | Hig | 0.55 | 8.4 | 0.00 | Aug 5, 2024 | Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager. | ||
| CVE-2024-23380 | Hig | 0.55 | 8.4 | 0.00 | Jul 1, 2024 | Memory corruption while handling user packets during VBO bind operation. | ||
| CVE-2024-23373 | Hig | 0.55 | 8.4 | 0.00 | Jul 1, 2024 | Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released. | ||
| CVE-2024-23372 | Hig | 0.55 | 8.4 | 0.00 | Jul 1, 2024 | Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size. | ||
| CVE-2024-21461 | Hig | 0.55 | 8.4 | 0.00 | Jul 1, 2024 | Memory corruption while performing finish HMAC operation when context is freed by keymaster. | ||
| CVE-2025-21487 | Hig | 0.53 | 8.2 | 0.00 | Sep 24, 2025 | Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. | ||
| CVE-2024-53026 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. | ||
| CVE-2024-53021 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while processing goodbye RTCP packet from network. | ||
| CVE-2024-53020 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. | ||
| CVE-2024-45552 | Hig | 0.53 | 8.2 | 0.00 | Apr 7, 2025 | Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. | ||
| CVE-2024-49839 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Memory corruption during management frame processing due to mismatch in T2LM info element. | ||
| CVE-2024-49838 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Information disclosure while parsing the OCI IE with invalid length. | ||
| CVE-2024-38408 | Hig | 0.53 | 8.2 | 0.00 | Nov 4, 2024 | Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. | ||
| CVE-2024-33073 | Hig | 0.53 | 8.2 | 0.00 | Oct 7, 2024 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. | ||
| CVE-2025-47357 | Hig | 0.52 | 8.0 | 0.00 | Nov 4, 2025 | Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions. | ||
| CVE-2026-21366 | Hig | 0.51 | 7.8 | 0.00 | Aug 4, 2026 | Memory corruption while processing a packet with a size close to the maximum allowed value. | ||
| CVE-2025-59606 | Hig | 0.51 | 7.8 | 0.00 | Jun 1, 2026 | Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization. | ||
| CVE-2025-59604 | Hig | 0.51 | 7.8 | 0.00 | Jun 1, 2026 | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. | ||
| CVE-2025-47389 | Hig | 0.51 | 7.8 | 0.00 | Apr 6, 2026 | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. | ||
| CVE-2025-47373 | Hig | 0.51 | 7.8 | 0.00 | Mar 2, 2026 | Memory Corruption when accessing buffers with invalid length during TA invocation. |
- risk 0.55cvss 8.4epss 0.00
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
- risk 0.55cvss 8.4epss 0.00
Memory corruption while handling user packets during VBO bind operation.
- risk 0.55cvss 8.4epss 0.00
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
- risk 0.55cvss 8.4epss 0.00
Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.
- risk 0.55cvss 8.4epss 0.00
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
- risk 0.53cvss 8.2epss 0.00
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while processing goodbye RTCP packet from network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
- risk 0.53cvss 8.2epss 0.00
Memory corruption during management frame processing due to mismatch in T2LM info element.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while parsing the OCI IE with invalid length.
- risk 0.53cvss 8.2epss 0.00
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
- risk 0.52cvss 8.0epss 0.00
Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing a packet with a size close to the maximum allowed value.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption when accessing buffers with invalid length during TA invocation.
Page 2 of 9