Qualcomm WCN6755 Firmware vulnerabilities

201 CVEs affecting Qualcomm WCN6755 Firmware, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57554, published 2026-10-06.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability, published 2026-03-02. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-03-03. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption while using alignments for memory allocation.
• CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability, published 2025-06-03. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-06-03. EPSS: 1% chance of exploitation in the next 30 days. Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
• CVE-2025-21479: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability, published 2025-06-03. High severity, CVSS 8.6. Actively exploited: in CISA KEV since 2025-06-03. EPSS: 0.8% chance of exploitation in the next 30 days. Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
• CVE-2025-21480: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability, published 2025-06-03. High severity, CVSS 8.6. Actively exploited: in CISA KEV since 2025-06-03. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2025-21483, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2025-27034, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while selecting the PLMN from SOR failed list.
• CVE-2024-45558, published 2025-01-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2025-21459, published 2025-05-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing per STA profile in ML IE.
• CVE-2025-21450, published 2025-07-08. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Cryptographic issue occurs due to use of insecure connection method while downloading.

Latest

• CVE-2026-57554, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
• CVE-2026-57545, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when processing draw objects of incorrect type during graphics command list execution.
• CVE-2026-25302, published 2026-10-06. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
• CVE-2026-25291, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
• CVE-2026-25272, published 2026-10-06. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
• CVE-2026-25270, published 2026-10-06. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
• CVE-2026-25269, published 2026-10-06. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
• CVE-2026-25267, published 2026-10-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
• CVE-2026-25263, published 2026-10-06. Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
• CVE-2026-25294, published 2026-09-17. High severity, CVSS 7.4. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS while parsing frame during channel usage.