Qualcomm Snapdragon 8c Compute Platform (sc8180xp-Ad) Firmware vulnerabilities

40 CVEs affecting Qualcomm Snapdragon 8c Compute Platform (sc8180xp-Ad) Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25267, published 2026-10-06.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2024-23359, published 2024-09-02. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2025-21448, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while parsing SSID in action frames.
• CVE-2026-25275, published 2026-09-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-24077, published 2026-08-04. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
• CVE-2024-33016, published 2024-09-02. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. memory corruption when an invalid firehose patch command is invoked.
• CVE-2025-47383, published 2026-03-02. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2024-23362, published 2024-09-02. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-33065, published 2024-10-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while taking snapshot when an offset variable is set by camera driver.

Latest

• CVE-2026-25267, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
• CVE-2026-25263, published 2026-10-06. Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
• CVE-2026-24075, published 2026-09-17. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
• CVE-2026-24076, published 2026-08-04. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing registry values with incorrect types using a direct query method.
• CVE-2026-21379, published 2026-07-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
• CVE-2025-59611, published 2026-06-01. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in diagnostic services due to absence of input validation
• CVE-2026-21376, published 2026-04-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
• CVE-2026-21374, published 2026-04-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.