Qualcomm Snapdragon 821 Mobile Platform Firmware vulnerabilities

13 CVEs affecting Qualcomm Snapdragon 821 Mobile Platform Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-27074, published 2025-11-04.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33080, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2023-43511, published 2024-01-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
• CVE-2023-28586, published 2023-12-05. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
• CVE-2023-33030, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in HLOS while running playready use-case.
• CVE-2023-28560, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
• CVE-2023-21628, published 2023-06-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
• CVE-2022-22076, published 2023-06-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. information disclosure due to cryptographic issue in Core during RPMB read request.
• CVE-2023-28546, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption in SPS Application while exporting public key in sorter TA.
• CVE-2023-33059, published 2023-11-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio while processing the VOC packet data from ADSP.
• CVE-2024-21461, published 2024-07-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Latest

• CVE-2025-27074, published 2025-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a GP command response.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2023-33110, published 2024-01-02. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event…