Qualcomm SDX80M Firmware vulnerabilities

21 CVEs affecting Qualcomm SDX80M Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47345, published 2026-01-07.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-27034, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while selecting the PLMN from SOR failed list.
• CVE-2025-21450, published 2025-07-08. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Cryptographic issue occurs due to use of insecure connection method while downloading.
• CVE-2024-49846, published 2025-05-06. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption while decoding of OTA messages from T3448 IE.
• CVE-2024-38426, published 2025-03-03. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. While processing the authentication message in UE, improper authentication may lead to information disclosure.
• CVE-2024-49847, published 2025-05-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
• CVE-2024-38404, published 2025-02-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
• CVE-2024-45549, published 2025-04-07. High severity, CVSS 7.7. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while creating MQ channels.
• CVE-2024-43046, published 2025-04-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2024-43056, published 2025-03-03. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS during hypervisor virtual I/O operation in a virtual machine.
• CVE-2024-49841, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

Latest

• CVE-2025-47345, published 2026-01-07. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue may occur while encrypting license data.
• CVE-2025-27032, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21465, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-21422, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
• CVE-2024-53009, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while operating the mailbox in Automotive.
• CVE-2024-53010, published 2025-06-03. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption may occur while attaching VM when the HLOS retains access to VM.