Qualcomm Snapdragon 835 Mobile Pc Firmware vulnerabilities

12 CVEs affecting Qualcomm Snapdragon 835 Mobile Pc Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21427, published 2025-07-08.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-33048, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-38426, published 2025-03-03. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. While processing the authentication message in UE, improper authentication may lead to information disclosure.
• CVE-2025-21427, published 2025-07-08. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
• CVE-2024-33060, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33052, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when user provides data for FM HCI command control operations.
• CVE-2024-33042, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when Alternative Frequency offset value is set to 255.
• CVE-2024-45562, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during concurrent access to server info object due to unprotected critical field.
• CVE-2023-28547, published 2024-04-01. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in SPS Application while requesting for public key in sorter TA.
• CVE-2023-33066, published 2024-03-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio while processing RT proxy port register driver.
• CVE-2023-43528, published 2024-05-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Latest

• CVE-2025-21453, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
• CVE-2024-33067, published 2025-01-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.