qualcomm has 15 CVEs on record. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 15. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-126 (5) and CWE-787 (3). Most affected products: cologne_firmware (9), wsa8845h_firmware (2), ar8035_firmware (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 15 prev 0
Products
- cologne_firmware 9
- wsa8845h_firmware 2
- ar8035_firmware 1
- iqx5121_firmware 1
- lemans_au_lgit_firmware 1
- q-7790_firmware 1
Worst active — by depth score
CVE-2026-25283High· 8.8Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.48CVE-2026-25290High· 7.8Memory Corruption when validating large data buffers from external sources using addition to check buffer length.43CVE-2026-25282High· 7.9Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.43CVE-2026-25280High· 7.8Memory corruption when processing escape handling flow with insufficient user buffer sizes.43CVE-2026-25278High· 7.8Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.43
qualcomm vulnerabilities
CVEs affecting qualcomm, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-24073High· 7.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
CVE-2026-24081High· 7.4Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
CVE-2026-24075High· 7.8Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
CVE-2026-24074High· 7.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
CVE-2026-25261Medium· 6.7Memory corruption while processing rear sensor IOCTL calls.
Memory corruption while processing rear sensor IOCTL calls.
CVE-2025-59607High· 7.8Memory Corruption when copying large input data exceeds normal allocation limits.
Memory Corruption when copying large input data exceeds normal allocation limits.
CVE-2026-25281High· 7.4Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
CVE-2026-25275High· 7.5Transient DOS when processing authentication frames with invalid FILS information element header lengths.
Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-25282High· 7.9Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
CVE-2026-25278High· 7.8Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
CVE-2026-25290High· 7.8Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
CVE-2026-25284High· 7.3Information Disclosure when a pointer is reused after being deallocated.
Information Disclosure when a pointer is reused after being deallocated.
CVE-2026-25283High· 8.8Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
CVE-2026-25294High· 7.4Transient DOS while parsing frame during channel usage.
Transient DOS while parsing frame during channel usage.
CVE-2026-25280High· 7.8Memory corruption when processing escape handling flow with insufficient user buffer sizes.
Memory corruption when processing escape handling flow with insufficient user buffer sizes.