Qualcomm SA8530P Firmware vulnerabilities

98 CVEs affecting Qualcomm SA8530P Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-27070, published 2025-11-04.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45558, published 2025-01-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2024-33069, published 2024-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
• CVE-2024-33018, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33049, published 2024-10-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-21479, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS during music playback of ALAC content.
• CVE-2024-33014, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-49838, published 2025-02-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while parsing the OCI IE with invalid length.
• CVE-2024-33057, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33050, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Latest

• CVE-2025-27070, published 2025-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing encryption and decryption commands.
• CVE-2025-27064, published 2025-11-04. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while registering commands from clients with diag through diagHal.
• CVE-2025-27054, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-27030, published 2025-09-24. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. information disclosure while invoking calibration data from user space to update firmware size.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21481, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing private key encryption in trusted application.
• CVE-2025-21472, published 2025-08-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while capturing logs as eSE debug messages are logged.
• CVE-2025-21465, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while reading data from an image using specified offset and size parameters.