Qualcomm Snapdragon 7c Compute Platform (sc7180-Ac) Firmware vulnerabilities

16 CVEs affecting Qualcomm Snapdragon 7c Compute Platform (sc7180-Ac) Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47387, published 2025-12-18.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2024-33016, published 2024-09-02. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-33065, published 2024-10-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while taking snapshot when an offset variable is set by camera driver.
• CVE-2025-21441, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
• CVE-2025-21440, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
• CVE-2025-21438, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while IOCTL call is invoked from user-space to read board data.
• CVE-2025-21423, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
• CVE-2025-21421, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing escape code in API.
• CVE-2025-47387, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing IOCTLs for JPEG data without verification.

Latest

• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-21481, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27076, published 2025-08-06. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing simultaneous requests via escape path.
• CVE-2025-27068, published 2025-08-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing an IOCTL command with an arbitrary address.
• CVE-2025-21465, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while reading data from an image using specified offset and size parameters.