Qualcomm SA8540P Firmware vulnerabilities

240 CVEs affecting Qualcomm SA8540P Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25302, published 2026-10-06.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-40507, published 2023-06-06. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2022-40516, published 2023-01-09. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Memory corruption in Core due to stack-based buffer overflow.
• CVE-2022-40520, published 2023-01-09. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption due to stack-based buffer overflow in Core
• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45558, published 2025-01-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2024-33069, published 2024-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
• CVE-2024-33018, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33049, published 2024-10-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-21479, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS during music playback of ALAC content.
• CVE-2024-33014, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing ESP IE from beacon/probe response frame.

Latest

• CVE-2026-25302, published 2026-10-06. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
• CVE-2026-25278, published 2026-09-17. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
• CVE-2026-24080, published 2026-08-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when handling malformed request parameters in the fingerprint TA.
• CVE-2026-21366, published 2026-08-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a packet with a size close to the maximum allowed value.
• CVE-2025-59606, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
• CVE-2025-59605, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing device identifier strings that exceed the expected maximum length.
• CVE-2025-59604, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
• CVE-2025-47389, published 2026-04-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
• CVE-2025-47373, published 2026-03-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when accessing buffers with invalid length during TA invocation.
• CVE-2025-47366, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.