Qualcomm Snapdragon 8cx Compute Platform (sc8180x-Aa) Firmware vulnerabilities

30 CVEs affecting Qualcomm Snapdragon 8cx Compute Platform (sc8180x-Aa) Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47387, published 2025-12-18.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2024-23359, published 2024-09-02. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2025-21448, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-47318, published 2025-09-24. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2024-33016, published 2024-09-02. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-23362, published 2024-09-02. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-33065, published 2024-10-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while taking snapshot when an offset variable is set by camera driver.
• CVE-2024-21481, published 2024-08-05. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
• CVE-2024-43046, published 2025-04-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. There may be information disclosure during memory re-allocation in TZ Secure OS.

Latest

• CVE-2025-47387, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing IOCTLs for JPEG data without verification.
• CVE-2025-27054, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-47327, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while encoding the image data.
• CVE-2025-47316, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption due to double free when multiple threads race to set the timestamp store.
• CVE-2025-27032, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21481, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27076, published 2025-08-06. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing simultaneous requests via escape path.