Qualcomm 9206 Lte Modem Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Qualcomm 9206 Lte Modem Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (46)

• CVE-2023-22388 — CVSS 9.8 (critical): Memory Corruption in Multi-mode Call Processor while processing bit mask API.
• CVE-2023-33030 — CVSS 9.3 (critical): Memory corruption in HLOS while running playready use-case.
• CVE-2023-43551 — CVSS 9.1 (critical): Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send…
• CVE-2017-18153 — CVSS 8.4 (high): A race condition exists in a driver potentially leading to a use-after-free condition.
• CVE-2024-33056 — CVSS 8.4 (high): Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2023-33033 — CVSS 8.4 (high): Memory corruption in Audio during playback with speaker protection.
• CVE-2024-21468 — CVSS 8.4 (high): Memory corruption when there is failed unmap operation in GPU.
• CVE-2022-40507 — CVSS 8.4 (high): Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2023-33066 — CVSS 8.4 (high): Memory corruption in Audio while processing RT proxy port register driver.
• CVE-2023-21665 — CVSS 8.4 (high): Memory corruption in Graphics while importing a file.
• CVE-2016-10408 — CVSS 8.4 (high): QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is…
• CVE-2022-33287 — CVSS 8.2 (high): Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
• CVE-2023-24848 — CVSS 8.2 (high): Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
• CVE-2023-24849 — CVSS 8.2 (high): Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
• CVE-2022-33291 — CVSS 8.2 (high): Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
• CVE-2023-22385 — CVSS 8.2 (high): Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
• CVE-2024-23359 — CVSS 8.2 (high): Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
• CVE-2022-40503 — CVSS 8.2 (high): Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
• CVE-2022-40505 — CVSS 8.2 (high): Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
• CVE-2023-28550 — CVSS 7.8 (high): Memory corruption in MPP performance while accessing DSM watermark using external memory address.
• CVE-2018-11816 — CVSS 7.8 (high): Crafted Binder Request Causes Heap UAF in MediaServer
• CVE-2023-28551 — CVSS 7.8 (high): Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
• CVE-2023-33017 — CVSS 7.8 (high): Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
• CVE-2023-33018 — CVSS 7.8 (high): Memory corruption while using the UIM diag command to get the operators name.
• CVE-2023-33059 — CVSS 7.8 (high): Memory corruption in Audio while processing the VOC packet data from ADSP.
• CVE-2023-33120 — CVSS 7.8 (high): Memory corruption in Audio when memory map command is executed consecutively in ADSP.
• CVE-2024-38422 — CVSS 7.8 (high): Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-38423 — CVSS 7.8 (high): Memory corruption while processing GPU page table switch.
• CVE-2025-27053 — CVSS 7.8 (high): Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2025-47320 — CVSS 7.8 (high): Memory corruption while processing MFC channel configuration during music playback.
• CVE-2025-21454 — CVSS 7.5 (high): Transient DOS while processing received beacon frame.
• CVE-2023-43511 — CVSS 7.5 (high): Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next…
• CVE-2022-33304 — CVSS 7.5 (high): Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
• CVE-2024-23353 — CVSS 7.5 (high): Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2025-21428 — CVSS 7.5 (high): Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
• CVE-2025-21429 — CVSS 7.5 (high): Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
• CVE-2022-40521 — CVSS 7.5 (high): Transient DOS due to improper authorization in Modem
• CVE-2023-33080 — CVSS 7.5 (high): Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2025-47383 — CVSS 7.2 (high): Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
• CVE-2025-21482 — CVSS 7.1 (high): Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2022-22076 — CVSS 7.1 (high): information disclosure due to cryptographic issue in Core during RPMB read request.
• CVE-2022-33302 — CVSS 6.8 (medium): Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
• CVE-2022-33289 — CVSS 6.8 (medium): Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
• CVE-2023-33069 — CVSS 6.7 (medium): Memory corruption in Audio while processing the calibration data returned from ACDB loader.
• CVE-2023-33067 — CVSS 6.7 (medium): Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
• CVE-2023-33068 — CVSS 6.7 (medium): Memory corruption in Audio while processing IIR config data from AFE calibration block.