Qualcomm Snapdragon X65 5G Modem Rf System vulnerabilities, page 5
222 vulnerabilities
Known vulnerabilities in Qualcomm Snapdragon X65 5G Modem Rf System, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2024-33066qualcomm, inc. · snapdragon +71 moreImproper Input Validation in WLAN Resource ManagerMemory corruption while redirecting log file to any file location with any file name.EPSS0.60%HighCVE-2024-33068qualcomm, inc. · snapdragon +121 moreUse After Free in WLAN Host CommunicationTransient DOS while parsing fragments of MBSSID IE from beacon frame.EPSS0.25%HighCVE-2024-33044qualcomm, inc. · snapdragon +208 moreImproper Validation of Array Index in HypervisorMemory corruption while Configuring the SMR/S2CR register in Bypass mode.EPSS0.10%HighCVE-2024-33045qualcomm, inc. · snapdragon +175 moreReturn of Stack Variable Address in BusesMemory corruption when BTFM client sends new messages over Slimbus to ADSP.EPSS0.12%HighCVE-2024-33050qualcomm, inc. · snapdragon +252 moreBuffer Over-read in WLAN Host CommunicationTransient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.EPSS0.30%HighCVE-2024-33012qualcomm, inc. · snapdragon +247 moreBuffer Over-read in WLAN HostTransient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.EPSS0.28%HighCVE-2024-33048qualcomm, inc. · snapdragon +187 moreBuffer Over-read in WLAN HostTransient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.EPSS0.30%HighCVE-2024-33060qualcomm, inc. · snapdragon +243 moreUse After Free in DSP ServiceMemory corruption when two threads try to map and unmap a single node simultaneously.EPSS0.17%HighCVE-2024-33010qualcomm, inc. · snapdragon +246 moreUse After Free in WLAN HostTransient DOS while parsing fragments of MBSSID IE from beacon frame.EPSS0.28%HighCVE-2024-33019qualcomm, inc. · snapdragon +148 moreBuffer Over-read in WLAN HostTransient DOS while parsing the received TID-to-link mapping action frame.EPSS0.28%HighCVE-2024-33073qualcomm, inc. · snapdragon +158 moreBuffer Over-read in WLAN Host CommunicationInformation disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.EPSS0.35%MediumCVE-2024-33016qualcomm, inc. · snapdragon +331 moreImproper Restriction of Operations within the Bounds of a Memory Buffer in Storagememory corruption when an invalid firehose patch command is invoked.EPSS0.15%HighCVE-2024-33025qualcomm, inc. · snapdragon +167 moreBuffer Over-read in WLAN HostTransient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.EPSS0.28%HighCVE-2024-33023qualcomm, inc. · snapdragon +151 moreUse After Free in Graphics LinuxMemory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.EPSS0.11%HighCVE-2024-33058qualcomm, inc. · snapdragon +189 moreInsufficient Granularity of Access Control in CoreMemory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.EPSS0.09%HighCVE-2024-33063qualcomm, inc. · snapdragon +123 moreInteger Overflow or Wraparound in WLAN Host CommunicationTransient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.EPSS0.26%HighCVE-2024-33056qualcomm, inc. · snapdragon +323 moreBuffer Over-read in MProcMemory corruption when allocating and accessing an entry in an SMEM partition continuously.EPSS0.10%HighCVE-2024-33018qualcomm, inc. · snapdragon +150 moreBuffer Over-read in WLAN HostTransient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.EPSS0.33%HighCVE-2024-33014qualcomm, inc. · snapdragon +319 moreBuffer Over-read in WLAN HostTransient DOS while parsing ESP IE from beacon/probe response frame.EPSS0.32%HighCVE-2024-33024qualcomm, inc. · snapdragon +179 moreInteger Overflow or Wraparound in WLAN HostTransient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.EPSS0.28%