Qualcomm Qca2066 vulnerabilities, page 5
118 vulnerabilities
Known vulnerabilities in Qualcomm Qca2066, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-25263qualcomm, inc. · snapdragon +160 moreOut of Bounds write in Linux CameraMemory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.EPSS0.06%MediumCVE-2026-25274qualcomm, inc. · snapdragon +45 moreUse After Free in Windows WLAN HostMemory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.EPSS0.07%HighCVE-2026-25292qualcomm, inc. · snapdragon +208 moreImproper Validation of Syntactic Correctness of Input in Automotive Linux OSMemory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.EPSS0.15%HighCVE-2026-57554qualcomm, inc. · snapdragon +212 moreUse After Free in DSP ServiceMemory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.EPSS0.07%HighCVE-2026-57545qualcomm, inc. · snapdragon +211 moreUntrusted Pointer Dereference in GraphicsMemory corruption when processing draw objects of incorrect type during graphics command list execution.EPSS0.08%HighCVE-2026-24085qualcomm, inc. · snapdragon +266 moreStack-based Buffer Overflow in DisplayMemory Corruption when processing display command line information due to improper initialization of a variable.EPSS0.10%HighCVE-2026-24091qualcomm, inc. · snapdragon +266 moreImproper Validation of Syntactic Correctness of Input in DisplayMemory corruption while processing fastboot commands with improperly formatted input.EPSS0.10%MediumCVE-2026-24076qualcomm, inc. · snapdragon +52 moreBuffer Copy Without Checking Size of Input in Bluetooth HOSTMemory Corruption when processing registry values with incorrect types using a direct query method.EPSS0.11%HighCVE-2026-24092qualcomm, inc. · snapdragon +215 moreImproper Validation of Syntactic Correctness of Input in DisplayMemory Corruption when processing fastboot commands to set display mode.EPSS0.10%HighCVE-2026-24090qualcomm, inc. · snapdragon +214 moreMissing Authentication for Critical Function in HLOSCryptographic issue while processing partition table entries allows unauthorized modification of boot flow.EPSS0.06%HighCVE-2026-24087qualcomm, inc. · snapdragon +212 moreImproper Validation of Syntactic Correctness of Input in KernelMemory corruption while processing fastboot OEM commands.EPSS0.10%HighCVE-2026-24082qualcomm, inc. · snapdragon +173 moreUse After Free in Automotive GPUMemory Corruption when copying data from a freed source while executing performance counter deselect operation.EPSS0.07%HighCVE-2026-24089qualcomm, inc. · snapdragon +216 moreImproper Validation of Syntactic Correctness of Input in KernelMemory corruption while processing fastboot commands with invalid input.EPSS0.10%HighCVE-2023-21658qualcomm, inc. · snapdragon +151 moreBuffer Over-Read in WLAN FirmwareTransient DOS in WLAN Firmware while processing the received beacon or probe response frame.EPSS0.38%HighCVE-2023-21659qualcomm, inc. · snapdragon +270 moreBuffer Over-read in WLAN FirmwareTransient DOS in WLAN Firmware while processing frames with missing header fields.EPSS0.38%HighCVE-2023-43511qualcomm, inc. · snapdragon +350 moreLoop with Unreachable Exit Condition (Infinite Loop) in WLAN FirmwareTransient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.EPSS0.32%HighCVE-2023-43533qualcomm, inc. · snapdragon +232 moreBuffer Over-read in WLAN FirmwareTransient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.EPSS0.32%HighCVE-2023-43522qualcomm, inc. · snapdragon +280 moreNULL Pointer Dereference in WLAN FirmwareTransient DOS while key unwrapping process, when the given encrypted key is empty or NULL.EPSS0.32%HighCVE-2023-43536qualcomm, inc. · snapdragon +303 moreBuffer Over-read in WLAN FirmwareTransient DOS while parse fils IE with length equal to 1.EPSS0.32%HighCVE-2023-28573qualcomm, inc. · snapdragon +195 moreImproper Validation of Array Index in WLAN HALMemory corruption in WLAN HAL while parsing WMI command parameters.EPSS0.12%