Qualcomm QCM8550 Firmware vulnerabilities

263 CVEs affecting Qualcomm QCM8550 Firmware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47348, published 2026-01-07.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability, published 2025-06-03. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-06-03. EPSS: 1% chance of exploitation in the next 30 days. Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
• CVE-2023-33106: Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.8% chance of exploitation in the next 30 days. Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
• CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2023-24855, published 2023-10-03. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in Modem while processing security related configuration before AS Security Exchange.
• CVE-2023-33028, published 2023-10-03. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
• CVE-2023-28588, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS in Bluetooth Host while rfc slot allocation.
• CVE-2023-33044, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS in Data modem while handling TLB control messages from the Network.
• CVE-2023-33043, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
• CVE-2023-33045, published 2023-11-07. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Latest

• CVE-2025-47348, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing identity credential operations in the trusted application.
• CVE-2025-47337, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while accessing a synchronization object during concurrent operations.
• CVE-2025-47334, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing shared command buffer packet between camera userspace and kernel.
• CVE-2025-47333, published 2026-01-07. Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while handling buffer mapping operations in the cryptographic driver.
• CVE-2025-47332, published 2026-01-07. Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a config call from userspace.
• CVE-2025-47331, published 2026-01-07. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing a firmware event.
• CVE-2025-47330, published 2026-01-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS while parsing video packets received from the video firmware.
• CVE-2025-47323, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while routing GPR packets between user and root when handling large data packet.
• CVE-2025-47322, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while handling IOCTL calls to set mode.
• CVE-2025-47321, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while copying packets received from unix clients.