Qualcomm Sm6370 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Qualcomm Sm6370 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (72)

• CVE-2025-21483 — CVSS 9.8 (critical): Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2025-21450 — CVSS 9.1 (critical): Cryptographic issue occurs due to use of insecure connection method while downloading.
• CVE-2024-33060 — CVSS 8.4 (high): Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-33045 — CVSS 8.4 (high): Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
• CVE-2024-33056 — CVSS 8.4 (high): Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
• CVE-2023-33023 — CVSS 8.4 (high): Memory corruption while processing finish_sign command to pass a rsp buffer.
• CVE-2024-23373 — CVSS 8.4 (high): Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
• CVE-2024-21461 — CVSS 8.4 (high): Memory corruption while performing finish HMAC operation when context is freed by keymaster.
• CVE-2023-28547 — CVSS 8.4 (high): Memory corruption in SPS Application while requesting for public key in sorter TA.
• CVE-2024-21468 — CVSS 8.4 (high): Memory corruption when there is failed unmap operation in GPU.
• CVE-2024-33023 — CVSS 8.4 (high): Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
• CVE-2024-33035 — CVSS 8.4 (high): Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
• CVE-2024-21471 — CVSS 8.4 (high): Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
• CVE-2024-45552 — CVSS 8.2 (high): Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC…
• CVE-2024-38408 — CVSS 8.2 (high): Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2025-21427 — CVSS 8.2 (high): Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
• CVE-2025-21484 — CVSS 8.2 (high): Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
• CVE-2024-53026 — CVSS 8.2 (high): Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
• CVE-2024-53020 — CVSS 8.2 (high): Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
• CVE-2025-21487 — CVSS 8.2 (high): Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the…
• CVE-2024-53021 — CVSS 8.2 (high): Information disclosure may occur while processing goodbye RTCP packet from network.
• CVE-2025-21488 — CVSS 8.2 (high): Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
• CVE-2024-53024 — CVSS 7.8 (high): Memory corruption in display driver while detaching a device.
• CVE-2025-21424 — CVSS 7.8 (high): Memory corruption while calling the NPU driver APIs concurrently.
• CVE-2024-23356 — CVSS 7.8 (high): Memory corruption during session sign renewal request calls in HLOS.
• CVE-2025-27061 — CVSS 7.8 (high): Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-21432 — CVSS 7.8 (high): Memory corruption while retrieving the CBOR data from TA.
• CVE-2025-27054 — CVSS 7.8 (high): Memory corruption while processing a malformed license file during reboot.
• CVE-2025-21453 — CVSS 7.8 (high): Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
• CVE-2024-23368 — CVSS 7.8 (high): Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2025-21468 — CVSS 7.8 (high): Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character…
• CVE-2025-21481 — CVSS 7.8 (high): Memory corruption while performing private key encryption in trusted application.
• CVE-2024-21465 — CVSS 7.8 (high): Memory corruption while processing key blob passed by the user.
• CVE-2025-27062 — CVSS 7.8 (high): Memory corruption while handling client exceptions, allowing unauthorized channel access.
• CVE-2025-27053 — CVSS 7.8 (high): Memory corruption during PlayReady APP usecase while processing TA commands.
• CVE-2024-21475 — CVSS 7.8 (high): Memory corruption when the payload received from firmware is not as per the expected protocol size.
• CVE-2024-38402 — CVSS 7.8 (high): Memory corruption while processing IOCTL call for getting group info.
• CVE-2024-38415 — CVSS 7.8 (high): Memory corruption while handling session errors from firmware.
• CVE-2024-38422 — CVSS 7.8 (high): Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-38423 — CVSS 7.8 (high): Memory corruption while processing GPU page table switch.
• CVE-2025-27043 — CVSS 7.8 (high): Memory corruption while processing manipulated payload in video firmware.
• CVE-2025-27042 — CVSS 7.8 (high): Memory corruption while processing video packets received from video firmware.
• CVE-2024-43066 — CVSS 7.8 (high): Memory corruption while handling file descriptor during listener registration/de-registration.
• CVE-2024-49834 — CVSS 7.8 (high): Memory corruption while power-up or power-down sequence of the camera sensor.
• CVE-2024-49835 — CVSS 7.8 (high): Memory corruption while reading secure file.
• CVE-2024-53014 — CVSS 7.8 (high): Memory corruption may occur while validating ports and channels in Audio driver.
• CVE-2025-27066 — CVSS 7.5 (high): Transient DOS while processing an ANQP message.
• CVE-2024-23364 — CVSS 7.5 (high): Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon…
• CVE-2024-23385 — CVSS 7.5 (high): Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.
• CVE-2024-33010 — CVSS 7.5 (high): Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-33011 — CVSS 7.5 (high): Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2024-33012 — CVSS 7.5 (high): Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33014 — CVSS 7.5 (high): Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33050 — CVSS 7.5 (high): Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33051 — CVSS 7.5 (high): Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-53027 — CVSS 7.5 (high): Transient DOS may occur while processing the country IE.
• CVE-2025-21429 — CVSS 7.5 (high): Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
• CVE-2025-21449 — CVSS 7.5 (high): Transient DOS may occur while processing malformed length field in SSID IEs.
• CVE-2025-21452 — CVSS 7.5 (high): Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
• CVE-2025-21454 — CVSS 7.5 (high): Transient DOS while processing received beacon frame.
• CVE-2024-21469 — CVSS 7.3 (high): Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
• CVE-2025-21482 — CVSS 7.1 (high): Cryptographic issue while performing RSA PKCS padding decoding.
• CVE-2024-23362 — CVSS 7.1 (high): Cryptographic issue while parsing RSA keys in COBR format.
• CVE-2024-21462 — CVSS 7.1 (high): Transient DOS while loading the TA ELF file.
• CVE-2024-33016 — CVSS 6.8 (medium): memory corruption when an invalid firehose patch command is invoked.
• CVE-2025-21464 — CVSS 6.5 (medium): Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-21465 — CVSS 6.5 (medium): Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21433 — CVSS 6.2 (medium): Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
• CVE-2024-23357 — CVSS 6.2 (medium): Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
• CVE-2024-45551 — CVSS 6.2 (medium): Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure…
• CVE-2024-43046 — CVSS 5.5 (medium): There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2024-43051 — CVSS 5.5 (medium): Information disclosure while deriving keys for a session for any Widevine use case.