Qualcomm Snapdragon 765 5g Mobile Platform (sm7250-Aa) Firmware vulnerabilities

40 CVEs affecting Qualcomm Snapdragon 765 5g Mobile Platform (sm7250-Aa) Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47369, published 2026-01-07.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-21483, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2025-27034, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while selecting the PLMN from SOR failed list.
• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2024-23352, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
• CVE-2024-53026, published 2025-06-03. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2024-23359, published 2024-09-02. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2025-21430, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
• CVE-2025-21487, published 2025-09-24. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
• CVE-2025-21484, published 2025-09-24. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Latest

• CVE-2025-47369, published 2026-01-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
• CVE-2025-47348, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing identity credential operations in the trusted application.
• CVE-2025-47333, published 2026-01-07. Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while handling buffer mapping operations in the cryptographic driver.
• CVE-2025-47331, published 2026-01-07. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing a firmware event.
• CVE-2025-47330, published 2026-01-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS while parsing video packets received from the video firmware.
• CVE-2025-47321, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while copying packets received from unix clients.
• CVE-2025-47320, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing MFC channel configuration during music playback.
• CVE-2025-27063, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during video playback when video session open fails with time out error.
• CVE-2025-27070, published 2025-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing encryption and decryption commands.
• CVE-2025-27054, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a malformed license file during reboot.