Qualcomm Snapdragon x50 5g Modem-Rf System Firmware vulnerabilities

127 CVEs affecting Qualcomm Snapdragon x50 5g Modem-Rf System Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-27054, published 2025-10-09.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
• CVE-2023-33063: Qualcomm Multiple Chipsets Use-After-Free Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in DSP Services during a remote call from HLOS to DSP.
• CVE-2022-40507, published 2023-06-06. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2023-28588, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS in Bluetooth Host while rfc slot allocation.
• CVE-2023-28540, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
• CVE-2023-22385, published 2023-10-03. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
• CVE-2025-21483, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2022-40503, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
• CVE-2023-33027, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Firmware while parsing rsn ies.
• CVE-2023-24847, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in Modem while allocating DSM items.

Latest

• CVE-2025-27054, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a malformed license file during reboot.
• CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-27032, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
• CVE-2025-21487, published 2025-09-24. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
• CVE-2025-21484, published 2025-09-24. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
• CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2025-21481, published 2025-09-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while performing private key encryption in trusted application.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2025-21465, published 2025-08-06. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing the hash segment in an MBN file.