Qualcomm MSM8956 Firmware vulnerabilities

21 CVEs affecting Qualcomm MSM8956 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-40515, published 2023-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11207, published 2020-11-12. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2020-11170, published 2021-02-22. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25719, published 2022-10-19. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2022-22088, published 2023-01-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
CVE-2022-25720, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2022-25718, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
CVE-2022-33213, published 2023-03-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption in modem due to buffer overflow while processing a PPP packet
CVE-2022-25687, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
CVE-2022-40515, published 2023-03-10. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
CVE-2020-11269, published 2021-02-22. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Latest

CVE-2022-25705, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
CVE-2022-25694, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
CVE-2022-22075, published 2023-03-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information Disclosure in Graphics during GPU context switch.
CVE-2022-33233, published 2023-02-12. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption due to configuration weakness in modem wile sending command to write protected files.
CVE-2022-25695, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2022-25682, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2022-25743, published 2022-11-15. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…