Qualcomm SDX61 Firmware vulnerabilities

73 CVEs affecting Qualcomm SDX61 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57554, published 2026-10-06.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability, published 2026-03-02. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-03-03. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption while using alignments for memory allocation.
• CVE-2025-27034, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while selecting the PLMN from SOR failed list.
• CVE-2025-21450, published 2025-07-08. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Cryptographic issue occurs due to use of insecure connection method while downloading.
• CVE-2024-49838, published 2025-02-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while parsing the OCI IE with invalid length.
• CVE-2024-33051, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33050, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-23364, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
• CVE-2024-53027, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while processing the country IE.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2024-38426, published 2025-03-03. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. While processing the authentication message in UE, improper authentication may lead to information disclosure.

Latest

• CVE-2026-57554, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
• CVE-2026-25302, published 2026-10-06. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
• CVE-2026-24084, published 2026-08-04. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
• CVE-2026-24079, published 2026-08-04. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
• CVE-2026-24078, published 2026-08-04. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
• CVE-2026-25268, published 2026-07-06. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2026-24091, published 2026-06-01. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing fastboot commands with improperly formatted input.
• CVE-2026-24085, published 2026-06-01. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing display command line information due to improper initialization of a variable.
• CVE-2025-59605, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing device identifier strings that exceed the expected maximum length.
• CVE-2025-59604, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.