Qualcomm Immersive Home 214 Platform Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Qualcomm Immersive Home 214 Platform Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (88)

• CVE-2023-33083 — CVSS 9.8 (critical): Memory corruption in WLAN Host while processing RRM beacon on the AP.
• CVE-2023-33028 — CVSS 9.8 (critical): Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
• CVE-2024-33066 — CVSS 9.8 (critical): Memory corruption while redirecting log file to any file location with any file name.
• CVE-2023-33045 — CVSS 9.8 (critical): Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
• CVE-2023-33082 — CVSS 9.8 (critical): Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
• CVE-2026-25268 — CVSS 8.8 (high): Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2025-27060 — CVSS 8.8 (high): Memory corruption while performing SCM call with malformed inputs.
• CVE-2025-27059 — CVSS 8.8 (high): Memory corruption while performing SCM call.
• CVE-2025-27074 — CVSS 8.8 (high): Memory corruption while processing a GP command response.
• CVE-2023-21628 — CVSS 8.4 (high): Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
• CVE-2023-33088 — CVSS 8.4 (high): Memory corruption when processing cmd parameters while parsing vdev.
• CVE-2022-40532 — CVSS 8.4 (high): Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
• CVE-2024-33056 — CVSS 8.4 (high): Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2022-33275 — CVSS 8.4 (high): Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
• CVE-2023-33053 — CVSS 8.4 (high): Memory corruption in Kernel while parsing metadata.
• CVE-2024-33073 — CVSS 8.2 (high): Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2026-24088 — CVSS 8.2 (high): Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
• CVE-2024-38408 — CVSS 8.2 (high): Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2023-28560 — CVSS 7.8 (high): Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
• CVE-2023-43513 — CVSS 7.8 (high): Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary…
• CVE-2023-33063 — CVSS 7.8 (high) — actively exploited: Memory corruption in DSP Services during a remote call from HLOS to DSP.
• CVE-2024-23368 — CVSS 7.8 (high): Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2023-28544 — CVSS 7.8 (high): Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
• CVE-2023-28548 — CVSS 7.8 (high): Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
• CVE-2023-28549 — CVSS 7.8 (high): Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
• CVE-2023-28550 — CVSS 7.8 (high): Memory corruption in MPP performance while accessing DSM watermark using external memory address.
• CVE-2025-47339 — CVSS 7.8 (high): Memory corruption while deinitializing a HDCP session.
• CVE-2023-28557 — CVSS 7.8 (high): Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
• CVE-2023-28559 — CVSS 7.8 (high): Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
• CVE-2026-21367 — CVSS 7.6 (high): Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
• CVE-2024-33018 — CVSS 7.5 (high): Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33019 — CVSS 7.5 (high): Transient DOS while parsing the received TID-to-link mapping action frame.
• CVE-2024-33024 — CVSS 7.5 (high): Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33025 — CVSS 7.5 (high): Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33026 — CVSS 7.5 (high): Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33049 — CVSS 7.5 (high): Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-33011 — CVSS 7.5 (high): Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2023-21658 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
• CVE-2023-21659 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while processing frames with missing header fields.
• CVE-2023-21660 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing FT Information Elements.
• CVE-2023-21661 — CVSS 7.5 (high): Transient DOS while parsing WLAN beacon or probe-response frame.
• CVE-2023-24847 — CVSS 7.5 (high): Transient DOS in Modem while allocating DSM items.
• CVE-2023-33026 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing a NAN management frame.
• CVE-2023-33027 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing rsn ies.
• CVE-2023-33041 — CVSS 7.5 (high): Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
• CVE-2023-33047 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing no-inherit IES.
• CVE-2023-33048 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing t2lm buffers.
• CVE-2023-33056 — CVSS 7.5 (high): Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
• CVE-2023-33061 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
• CVE-2023-33062 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing a BTM request.
• CVE-2023-33080 — CVSS 7.5 (high): Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2023-33081 — CVSS 7.5 (high): Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
• CVE-2023-33089 — CVSS 7.5 (high): Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2023-33097 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while processing a FTMR frame.
• CVE-2023-33098 — CVSS 7.5 (high): Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33109 — CVSS 7.5 (high): Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
• CVE-2023-33116 — CVSS 7.5 (high): Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
• CVE-2023-43511 — CVSS 7.5 (high): Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next…
• CVE-2023-43522 — CVSS 7.5 (high): Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
• CVE-2023-43523 — CVSS 7.5 (high): Transient DOS while processing 11AZ RTT management action frame received through OTA.
• CVE-2023-43536 — CVSS 7.5 (high): Transient DOS while parse fils IE with length equal to 1.
• CVE-2024-33010 — CVSS 7.5 (high): Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-33012 — CVSS 7.5 (high): Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33013 — CVSS 7.5 (high): Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
• CVE-2024-33014 — CVSS 7.5 (high): Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33015 — CVSS 7.5 (high): Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor…
• CVE-2025-21435 — CVSS 7.5 (high): Transient DOS may occur while parsing extended IE in beacon.
• CVE-2025-21448 — CVSS 7.5 (high): Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21463 — CVSS 7.5 (high): Transient DOS while processing the EHT operation IE in the received beacon frame.
• CVE-2025-27066 — CVSS 7.5 (high): Transient DOS while processing an ANQP message.
• CVE-2025-27073 — CVSS 7.5 (high): Transient DOS while creating NDP instance.
• CVE-2025-47318 — CVSS 7.5 (high): Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-47326 — CVSS 7.5 (high): Transient DOS while handling command data during power control processing.
• CVE-2022-22076 — CVSS 7.1 (high): information disclosure due to cryptographic issue in Core during RPMB read request.
• CVE-2025-21482 — CVSS 7.1 (high): Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2024-21482 — CVSS 6.8 (medium): Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs…
• CVE-2023-28539 — CVSS 6.6 (medium): Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
• CVE-2024-21458 — CVSS 6.5 (medium): Information disclosure while handling SA query action frame.
• CVE-2024-21457 — CVSS 6.5 (medium): INformation disclosure while handling Multi-link IE in beacon frame.
• CVE-2024-21467 — CVSS 6.5 (medium): Information disclosure while handling beacon probe frame during scan entry generation in client side.
• CVE-2025-27040 — CVSS 6.5 (medium): Information disclosure may occur while processing the hypervisor log.
• CVE-2024-21459 — CVSS 6.5 (medium): Information disclosure while handling beacon or probe response frame in STA.
• CVE-2023-28563 — CVSS 6.1 (medium): Information disclosure in IOE Firmware while handling WMI command.
• CVE-2023-28554 — CVSS 6.1 (medium): Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
• CVE-2023-28569 — CVSS 6.1 (medium): Information disclosure in WLAN HAL while handling command through WMI interfaces.
• CVE-2023-28553 — CVSS 6.1 (medium): Information Disclosure in WLAN Host when processing WMI event command.
• CVE-2025-47331 — CVSS 6.1 (medium): Information disclosure while processing a firmware event.
• CVE-2025-59609 — CVSS 5.5 (medium): Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.