Qualcomm SA8775P Firmware vulnerabilities

263 CVEs affecting Qualcomm SA8775P Firmware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47366, published 2026-02-02.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33106: Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.8% chance of exploitation in the next 30 days. Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
• CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
• CVE-2023-33063: Qualcomm Multiple Chipsets Use-After-Free Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in DSP Services during a remote call from HLOS to DSP.
• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2023-33098, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33089, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2025-21483, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2024-45558, published 2025-01-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2023-43553, published 2024-03-04. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-43552, published 2024-03-04. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while processing MBSSID beacon containing several subelement IE.

Latest

• CVE-2025-47366, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
• CVE-2025-47364, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while calculating offset from partition start point.
• CVE-2025-47363, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when calculating oversized partition sizes without proper checks.
• CVE-2025-47393, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when accessing resources in kernel driver.
• CVE-2025-47348, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing identity credential operations in the trusted application.
• CVE-2025-47346, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a secure logging command in the trusted application.
• CVE-2025-47345, published 2026-01-07. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue may occur while encrypting license data.
• CVE-2025-47339, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while deinitializing a HDCP session.
• CVE-2025-47334, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing shared command buffer packet between camera userspace and kernel.
• CVE-2025-47333, published 2026-01-07. Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while handling buffer mapping operations in the cryptographic driver.