{"meta":{"title":"KEV entries: Qualcomm","description":"All KEV entries for vendor Qualcomm.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":12,"vendor":"Qualcomm","entries":12,"shareOfCatalogPercent":0.7,"ransomwareKnown":0,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-03-03","rank":23},"data":[{"cveID":"CVE-2026-21385","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability","dateAdded":"2026-03-03","dueDate":"2026-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-190"],"shortDescription":"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21385","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21385"},{"cveID":"CVE-2025-27038","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","dateAdded":"2025-06-03","dueDate":"2025-06-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ;   https://nvd.nist.gov/vuln/detail/CVE-2025-27038","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-27038"},{"cveID":"CVE-2025-21480","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","dateAdded":"2025-06-03","dueDate":"2025-06-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ;   https://nvd.nist.gov/vuln/detail/CVE-2025-21480","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21480"},{"cveID":"CVE-2025-21479","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","dateAdded":"2025-06-03","dueDate":"2025-06-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ;   https://nvd.nist.gov/vuln/detail/CVE-2025-21479","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21479"},{"cveID":"CVE-2024-43047","vendorProject":"Qualcomm","product":"Multiple Chipsets ","vulnerabilityName":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","dateAdded":"2024-10-08","dueDate":"2024-10-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. ","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/dsp-kernel/-/commit/0e27b6c7d2bd8d0453e4465ac2ca49a8f8c440e2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43047","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-43047"},{"cveID":"CVE-2023-33107","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Integer Overflow Vulnerability","dateAdded":"2023-12-05","dueDate":"2023-12-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-190"],"shortDescription":"Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/d66b799c804083ea5226cfffac6d6c4e7ad4968b;  https://nvd.nist.gov/vuln/detail/CVE-2023-33107","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33107"},{"cveID":"CVE-2023-33106","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability","dateAdded":"2023-12-05","dueDate":"2023-12-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-823"],"shortDescription":"Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/1e46e81dbeb69aafd5842ce779f07e617680fd58;  https://nvd.nist.gov/vuln/detail/CVE-2023-33106","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33106"},{"cveID":"CVE-2023-33063","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","dateAdded":"2023-12-05","dueDate":"2023-12-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/commit/2643808ddbedfaabbb334741873fb2857f78188a, https://git.codelinaro.org/clo/la/kernel/msm-4.14/-/commit/d43222efda5a01c9804d74a541e3c1be9b7fe110;  https://nvd.nist.gov/vuln/detail/CVE-2023-33063","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33063"},{"cveID":"CVE-2022-22071","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","dateAdded":"2023-12-05","dueDate":"2023-12-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/commit/586840fde350d7b8563df9889c8ce397e2c20dda;  https://nvd.nist.gov/vuln/detail/CVE-2022-22071","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-22071"},{"cveID":"CVE-2020-11261","vendorProject":"Qualcomm","product":"Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","vulnerabilityName":"Qualcomm Multiple Chipsets Improper Input Validation Vulnerability","dateAdded":"2021-12-01","dueDate":"2022-06-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-11261","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-11261"},{"cveID":"CVE-2021-1906","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-390"],"shortDescription":"Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1906","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1906"},{"cveID":"CVE-2021-1905","vendorProject":"Qualcomm","product":"Multiple Chipsets","vulnerabilityName":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1905","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1905"}]}