Qualcomm MSM8952 Firmware vulnerabilities

23 CVEs affecting Qualcomm MSM8952 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25262, published 2026-09-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11207, published 2020-11-12. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2016-10442, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, SDM630, MSM8976, MSM8937, SDM845, MSM8976, and MSM8952, when running module or kernel code with…
CVE-2020-11170, published 2021-02-22. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25719, published 2022-10-19. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2022-22088, published 2023-01-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
CVE-2022-25720, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2022-25718, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
CVE-2022-33213, published 2023-03-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption in modem due to buffer overflow while processing a PPP packet
CVE-2022-25687, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
CVE-2022-40515, published 2023-03-10. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Latest

CVE-2026-25262, published 2026-09-22. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a crafted ELF file in the Primary Bootloader.
CVE-2022-25705, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
CVE-2022-25694, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
CVE-2022-22075, published 2023-03-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information Disclosure in Graphics during GPU context switch.
CVE-2022-33233, published 2023-02-12. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption due to configuration weakness in modem wile sending command to write protected files.
CVE-2022-25695, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2022-25682, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…