Snapdragon 6 Gen 1 Mobile Platform Firmware
by Qualcomm
CVEs (52)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-47339 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while deinitializing a HDCP session. | ||
| CVE-2025-47323 | Hig | 0.51 | 7.8 | 0.00 | Dec 18, 2025 | Memory corruption while routing GPR packets between user and root when handling large data packet. | ||
| CVE-2025-47321 | Hig | 0.51 | 7.8 | 0.00 | Dec 18, 2025 | Memory corruption while copying packets received from unix clients. | ||
| CVE-2025-47354 | Hig | 0.51 | 7.8 | 0.00 | Oct 9, 2025 | Memory corruption while allocating buffers in DSP service. | ||
| CVE-2025-47317 | Hig | 0.51 | 7.8 | 0.00 | Sep 24, 2025 | Memory corruption due to global buffer overflow when a test command uses an invalid payload type. | ||
| CVE-2026-25292 | Hig | 0.49 | 7.6 | 0.00 | Aug 4, 2026 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. | ||
| CVE-2026-24084 | Hig | 0.49 | 7.5 | 0.00 | Aug 4, 2026 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. | ||
| CVE-2026-21381 | Hig | 0.49 | 7.6 | 0.00 | Apr 6, 2026 | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. | ||
| CVE-2026-21367 | Hig | 0.49 | 7.6 | 0.00 | Apr 6, 2026 | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. | ||
| CVE-2026-24092 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing fastboot commands to set display mode. | ||
| CVE-2026-24091 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with improperly formatted input. | ||
| CVE-2026-24089 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with invalid input. | ||
| CVE-2026-24087 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot OEM commands. | ||
| CVE-2026-24085 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing display command line information due to improper initialization of a variable. | ||
| CVE-2025-47383 | Hig | 0.47 | 7.2 | 0.00 | Mar 2, 2026 | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. | ||
| CVE-2026-24090 | Hig | 0.46 | 7.1 | 0.00 | Jun 1, 2026 | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. | ||
| CVE-2025-47334 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. | ||
| CVE-2025-47332 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing a config call from userspace. | ||
| CVE-2025-47319 | Med | 0.44 | 6.7 | 0.00 | Dec 18, 2025 | Information disclosure while exposing internal TA-to-TA communication APIs to HLOS | ||
| CVE-2025-47333 | Med | 0.43 | 6.6 | 0.00 | Jan 7, 2026 | Memory corruption while handling buffer mapping operations in the cryptographic driver. |
- risk 0.51cvss 7.8epss 0.00
Memory corruption while deinitializing a HDCP session.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while routing GPR packets between user and root when handling large data packet.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while copying packets received from unix clients.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while allocating buffers in DSP service.
- risk 0.51cvss 7.8epss 0.00
Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
- risk 0.49cvss 7.6epss 0.00
Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
- risk 0.49cvss 7.5epss 0.00
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
- risk 0.49cvss 7.6epss 0.00
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
- risk 0.49cvss 7.6epss 0.00
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing fastboot commands to set display mode.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with improperly formatted input.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with invalid input.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot OEM commands.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing display command line information due to improper initialization of a variable.
- risk 0.47cvss 7.2epss 0.00
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
- risk 0.46cvss 7.1epss 0.00
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing a config call from userspace.
- risk 0.44cvss 6.7epss 0.00
Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
- risk 0.43cvss 6.6epss 0.00
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Page 2 of 3