Qualcomm
Qualcomm Wcd9370 Firmware: vulnerabilities and CVEs
Qualcomm Wcd9370 Firmware has 1,024 published vulnerabilities, 112 of them in the last 12 months. 92 are rated critical and 12 are listed by CISA as actively exploited.
CVEs1,024
Last 12 months112
Critical92
Actively exploited12
All vulnerabilities in the catalogue →⭐ Follow this technology
🔴 Actively exploited (CISA KEV)
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-21385 | High (7.8) | 1.3% | ⚠ Active exploitation | Mar 2, 2026 | Memory corruption while using alignments for memory allocation. |
| CVE-2025-21480 | High (8.6) | 0.46% | ⚠ Active exploitation | Jun 3, 2025 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
| CVE-2025-27038 | High (7.5) | 1.0% | ⚠ Active exploitation | Jun 3, 2025 | Memory corruption while rendering graphics using Adreno GPU drivers in Chrome. |
| CVE-2025-21479 | High (8.6) | 0.84% | ⚠ Active exploitation | Jun 3, 2025 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
| CVE-2024-43047 | High (7.8) | 0.67% | ⚠ Active exploitation | Oct 7, 2024 | Memory corruption while maintaining memory maps of HLOS memory. |
| CVE-2022-22071 | High (7.8) | 0.46% | ⚠ Active exploitation | Jun 14, 2022 | Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,… |
| CVE-2023-33063 | High (7.8) | 0.69% | ⚠ Active exploitation | Dec 5, 2023 | Memory corruption in DSP Services during a remote call from HLOS to DSP. |
| CVE-2023-33106 | High (7.8) | 0.92% | ⚠ Active exploitation | Dec 5, 2023 | Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. |
| CVE-2023-33107 | High (7.8) | 0.89% | ⚠ Active exploitation | Dec 5, 2023 | Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. |
| CVE-2020-11261 | High (7.8) | 1.6% | ⚠ Active exploitation | Jun 9, 2021 | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,… |
| CVE-2021-1906 | Medium (5.5) | 0.52% | ⚠ Active exploitation | May 7, 2021 | Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,… |
| CVE-2021-1905 | High (7.8) | 1.5% | ⚠ Active exploitation | May 7, 2021 | Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial… |
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-25294 | High (7.4) | 0.10% | — | Sep 17, 2026 | Transient DOS while parsing frame during channel usage. |
| CVE-2026-25280 | High (7.8) | 0.07% | — | Sep 17, 2026 | Memory corruption when processing escape handling flow with insufficient user buffer sizes. |
| CVE-2026-25275 | High (7.5) | 0.19% | — | Sep 17, 2026 | Transient DOS when processing authentication frames with invalid FILS information element header lengths. |
| CVE-2026-25261 | High (7.8) | 0.07% | — | Sep 17, 2026 | Memory corruption while processing rear sensor IOCTL calls. |
| CVE-2026-24081 | High (7.4) | 0.10% | — | Sep 17, 2026 | Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. |
| CVE-2026-24075 | High (7) | 0.06% | — | Sep 17, 2026 | Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions. |
| CVE-2026-24074 | High (7.8) | 0.07% | — | Sep 17, 2026 | Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations. |
| CVE-2026-25292 | High (7.6) | 0.15% | — | Aug 4, 2026 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
| CVE-2026-25289 | Critical (9.6) | 0.19% | — | Aug 4, 2026 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. |
| CVE-2026-25288 | High (7.4) | 0.16% | — | Aug 4, 2026 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. |
| CVE-2026-24084 | High (7.5) | 0.25% | — | Aug 4, 2026 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. |
| CVE-2026-24079 | High (8.1) | 0.21% | — | Aug 4, 2026 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
| CVE-2026-24078 | Medium (6.5) | 0.17% | — | Aug 4, 2026 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
| CVE-2026-24077 | Medium (6.5) | 0.17% | — | Aug 4, 2026 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. |
| CVE-2026-24076 | Medium (6.7) | 0.11% | — | Aug 4, 2026 | Memory Corruption when processing registry values with incorrect types using a direct query method. |
| CVE-2026-25268 | High (8.8) | 0.11% | — | Jul 6, 2026 | Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations. |
| CVE-2026-21384 | Medium (5.3) | 0.08% | — | Jul 6, 2026 | Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits. |
| CVE-2026-21379 | High (7.8) | 0.10% | — | Jul 6, 2026 | Memory Corruption when allocating memory with sizes that exceed the maximum allowed value. |
| CVE-2026-21370 | Medium (5.3) | 0.08% | — | Jul 6, 2026 | Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values. |
| CVE-2026-21369 | Medium (5.3) | 0.08% | — | Jul 6, 2026 | Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification. |
| CVE-2026-21368 | Medium (5.3) | 0.08% | — | Jul 6, 2026 | Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks. |
| CVE-2025-59617 | High (7.3) | 0.09% | — | Jul 6, 2026 | Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input. |
| CVE-2025-59616 | High (7.8) | 0.09% | — | Jul 6, 2026 | Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory. |
| CVE-2025-59615 | High (7.8) | 0.09% | — | Jul 6, 2026 | Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization. |
| CVE-2026-25277 | High (8.8) | 0.07% | — | Jun 1, 2026 | Memory corruption while using Strongbox due to buffer overflow. |
| CVE-2026-25276 | High (8.8) | 0.07% | — | Jun 1, 2026 | Memory corruption while using Strongbox due to missing bounds check. |
| CVE-2026-25260 | High (7) | 0.05% | — | Jun 1, 2026 | Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications. |
| CVE-2026-25259 | High (7.8) | 0.07% | — | Jun 1, 2026 | Memory corruption while processing multiple IOCTL command for escape operations. |
| CVE-2026-24092 | High (7.2) | 0.10% | — | Jun 1, 2026 | Memory Corruption when processing fastboot commands to set display mode. |
| CVE-2026-24091 | High (7.2) | 0.10% | — | Jun 1, 2026 | Memory corruption while processing fastboot commands with improperly formatted input. |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.