Qualcomm Snapdragon 429 Mobile Firmware vulnerabilities

46 CVEs affecting Qualcomm Snapdragon 429 Mobile Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21433, published 2025-07-08.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-33048, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-49847, published 2025-05-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
• CVE-2023-43551, published 2024-06-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
• CVE-2024-38404, published 2025-02-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
• CVE-2025-21427, published 2025-07-08. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
• CVE-2024-33060, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33054, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
• CVE-2024-33052, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when user provides data for FM HCI command control operations.
• CVE-2024-53023, published 2025-03-03. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption may occur while accessing a variable during extended back to back tests.
• CVE-2023-43527, published 2024-05-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while parsing dts header atom in Video.

Latest

• CVE-2025-21433, published 2025-07-08. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
• CVE-2025-21453, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
• CVE-2024-49844, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while triggering commands in the PlayReady Trusted application.
• CVE-2024-49842, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
• CVE-2024-49830, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing an IOCTL call to set mixer controls.
• CVE-2024-49829, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption can occur during context user dumps due to inadequate checks on buffer length.
• CVE-2024-45581, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while sound model registration for voice activation with audio kernel driver.
• CVE-2024-45579, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.