Qualcomm SC8180X+SDX55 Firmware vulnerabilities

184 CVEs affecting Qualcomm SC8180X+SDX55 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47387, published 2025-12-18.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-40507, published 2023-06-06. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2020-11291, published 2021-06-09. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible buffer overflow while updating ikev2 parameters for delete payloads received during informational exchange due to lack of check of input validation for certain parameters received from the…
• CVE-2020-11285, published 2021-05-07. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
• CVE-2021-1975, published 2021-11-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
• CVE-2020-11279, published 2021-05-07. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
• CVE-2020-11292, published 2021-06-09. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
• CVE-2022-25736, published 2022-10-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
• CVE-2020-11182, published 2021-06-09. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
• CVE-2021-1933, published 2021-09-09. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
• CVE-2020-11274, published 2021-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Latest

• CVE-2025-47387, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing IOCTLs for JPEG data without verification.
• CVE-2025-27054, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21481, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27076, published 2025-08-06. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing simultaneous requests via escape path.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2025-21465, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-27055, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during the image encoding process.