Qualcomm Snapdragon 1100 Wearable Platform Firmware vulnerabilities

25 CVEs affecting Qualcomm Snapdragon 1100 Wearable Platform Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47383, published 2026-03-02.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-40507, published 2023-06-06. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2023-22385, published 2023-10-03. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
• CVE-2022-33304, published 2023-05-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
• CVE-2023-24849, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
• CVE-2023-24848, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
• CVE-2022-40521, published 2023-06-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to improper authorization in Modem
• CVE-2022-40505, published 2023-05-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
• CVE-2022-33291, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
• CVE-2022-33287, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
• CVE-2023-22388, published 2023-11-07. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Latest

• CVE-2025-47383, published 2026-03-02. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2024-33056, published 2024-12-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2023-33033, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio during playback with speaker protection.
• CVE-2023-33030, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in HLOS while running playready use-case.
• CVE-2023-33018, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while using the UIM diag command to get the operators name.
• CVE-2023-33017, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
• CVE-2023-28551, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.