Qualcomm Flight RB5 5g Firmware vulnerabilities

59 CVEs affecting Qualcomm Flight RB5 5g Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24082, published 2026-05-04.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33105, published 2024-03-04. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
• CVE-2023-33015, published 2023-09-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
• CVE-2023-43552, published 2024-03-04. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2025-21459, published 2025-05-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing per STA profile in ML IE.
• CVE-2024-33057, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33051, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33050, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33048, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2025-21454, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while processing received beacon frame.
• CVE-2025-21449, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS may occur while processing malformed length field in SSID IEs.

Latest

• CVE-2026-24082, published 2026-05-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
• CVE-2025-47404, published 2026-05-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
• CVE-2025-47401, published 2026-05-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing target power rate tables during channel configuration.
• CVE-2025-47398, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
• CVE-2025-47397, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
• CVE-2025-47366, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
• CVE-2025-27061, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27052, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing data packets in diag received from Unix clients.
• CVE-2025-27043, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing manipulated payload in video firmware.
• CVE-2025-27042, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing video packets received from video firmware.