Qualcomm APQ8076 Firmware vulnerabilities

73 CVEs affecting Qualcomm APQ8076 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21454, published 2025-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10574, published 2020-04-16. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2020-11207, published 2020-11-12. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2019-10609, published 2020-04-16. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Out of bound write can happen due to lack of check of array index value while calculating it. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2019-14062, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-10588, published 2020-04-16. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…
CVE-2019-14095, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2019-10594, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-10593, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2020-11272, published 2021-02-22. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a stale version later can lead to use after free condition in Snapdragon Auto,…
CVE-2019-14020, published 2020-04-16. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple Read overflows issue due to improper length check while decoding dedicated_eps_bearer_req/ act_def_context_req/ cs_serv_notification/ emm_info/ guti_realloc_cmd in Snapdragon Auto,…

Latest

CVE-2025-21454, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while processing received beacon frame.
CVE-2018-11816, published 2024-11-26. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Crafted Binder Request Causes Heap UAF in MediaServer
CVE-2023-33066, published 2024-03-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio while processing RT proxy port register driver.
CVE-2023-33033, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio during playback with speaker protection.
CVE-2023-33059, published 2023-11-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio while processing the VOC packet data from ADSP.
CVE-2023-33020, published 2023-09-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
CVE-2023-33019, published 2023-09-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
CVE-2023-28565, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVE-2023-28560, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
CVE-2022-40510, published 2023-08-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.