Qualcomm Snapdragon Ar2 Gen 1 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Qualcomm Snapdragon Ar2 Gen 1 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (71)

• CVE-2023-43553 — CVSS 9.8 (critical): Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-28581 — CVSS 9.8 (critical): Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
• CVE-2023-43552 — CVSS 9.8 (critical): Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2023-43538 — CVSS 9.3 (critical): Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
• CVE-2023-28578 — CVSS 9.3 (critical): Memory corruption in Core Services while executing the command for removing a single event listener.
• CVE-2023-43556 — CVSS 9.3 (critical): Memory corruption in Hypervisor when platform information mentioned is not aligned.
• CVE-2024-38420 — CVSS 8.8 (high): Memory corruption while configuring a Hypervisor based input virtual device.
• CVE-2023-21672 — CVSS 8.4 (high): Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
• CVE-2023-28547 — CVSS 8.4 (high): Memory corruption in SPS Application while requesting for public key in sorter TA.
• CVE-2023-33023 — CVSS 8.4 (high): Memory corruption while processing finish_sign command to pass a rsp buffer.
• CVE-2023-33119 — CVSS 8.4 (high): Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
• CVE-2023-43531 — CVSS 8.4 (high): Memory corruption while verifying the serialized header when the key pairs are generated.
• CVE-2023-43549 — CVSS 8.4 (high): Memory corruption while processing TPC target power table in FTM TPC.
• CVE-2024-21471 — CVSS 8.4 (high): Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
• CVE-2024-23351 — CVSS 8.4 (high): Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
• CVE-2024-23354 — CVSS 8.4 (high): Memory corruption when the IOCTL call is interrupted by a signal.
• CVE-2024-33045 — CVSS 8.4 (high): Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
• CVE-2024-33060 — CVSS 8.4 (high): Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-49838 — CVSS 8.2 (high): Information disclosure while parsing the OCI IE with invalid length.
• CVE-2024-49839 — CVSS 8.2 (high): Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2023-43542 — CVSS 7.8 (high): Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
• CVE-2024-21475 — CVSS 7.8 (high): Memory corruption when the payload received from firmware is not as per the expected protocol size.
• CVE-2023-28542 — CVSS 7.8 (high): Memory Corruption in WLAN HOST while fetching TX status information.
• CVE-2023-43550 — CVSS 7.8 (high): Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
• CVE-2023-24854 — CVSS 7.8 (high): Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
• CVE-2023-24851 — CVSS 7.8 (high): Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
• CVE-2023-22387 — CVSS 7.8 (high): Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
• CVE-2025-21468 — CVSS 7.8 (high): Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character…
• CVE-2025-27042 — CVSS 7.8 (high): Memory corruption while processing video packets received from video firmware.
• CVE-2024-33038 — CVSS 7.8 (high): Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
• CVE-2025-27061 — CVSS 7.8 (high): Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2024-38402 — CVSS 7.8 (high): Memory corruption while processing IOCTL call for getting group info.
• CVE-2023-22386 — CVSS 7.8 (high): Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
• CVE-2024-45553 — CVSS 7.8 (high): Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another…
• CVE-2024-45580 — CVSS 7.8 (high): Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
• CVE-2024-49833 — CVSS 7.8 (high): Memory corruption can occur in the camera when an invalid CID is used.
• CVE-2024-49834 — CVSS 7.8 (high): Memory corruption while power-up or power-down sequence of the camera sensor.
• CVE-2024-49841 — CVSS 7.8 (high): Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
• CVE-2024-49842 — CVSS 7.8 (high): Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
• CVE-2024-53014 — CVSS 7.8 (high): Memory corruption may occur while validating ports and channels in Audio driver.
• CVE-2024-53024 — CVSS 7.8 (high): Memory corruption in display driver while detaching a device.
• CVE-2025-21432 — CVSS 7.8 (high): Memory corruption while retrieving the CBOR data from TA.
• CVE-2023-28573 — CVSS 7.8 (high): Memory corruption in WLAN HAL while parsing WMI command parameters.
• CVE-2023-28567 — CVSS 7.8 (high): Memory corruption in WLAN HAL while handling command through WMI interfaces.
• CVE-2023-33115 — CVSS 7.8 (high): Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
• CVE-2024-53027 — CVSS 7.5 (high): Transient DOS may occur while processing the country IE.
• CVE-2024-21477 — CVSS 7.5 (high): Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
• CVE-2023-28584 — CVSS 7.5 (high): Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
• CVE-2025-27057 — CVSS 7.5 (high): Transient DOS while handling beacon frames with invalid IE header length.
• CVE-2024-23363 — CVSS 7.5 (high): Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
• CVE-2023-33015 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
• CVE-2024-33048 — CVSS 7.5 (high): Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33050 — CVSS 7.5 (high): Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33051 — CVSS 7.5 (high): Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-33057 — CVSS 7.5 (high): Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the…
• CVE-2023-33016 — CVSS 7.5 (high): Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
• CVE-2025-21446 — CVSS 7.5 (high): Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
• CVE-2025-21459 — CVSS 7.5 (high): Transient DOS while parsing per STA profile in ML IE.
• CVE-2023-43539 — CVSS 7.5 (high): Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
• CVE-2025-21449 — CVSS 7.5 (high): Transient DOS may occur while processing malformed length field in SSID IEs.
• CVE-2025-21454 — CVSS 7.5 (high): Transient DOS while processing received beacon frame.
• CVE-2024-21480 — CVSS 7.3 (high): Memory corruption while playing audio file having large-sized input buffer.
• CVE-2024-21463 — CVSS 7.3 (high): Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
• CVE-2025-21422 — CVSS 7.1 (high): Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
• CVE-2025-47366 — CVSS 7.1 (high): Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
• CVE-2024-33055 — CVSS 6.7 (medium): Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
• CVE-2023-43537 — CVSS 6.5 (medium): Information disclosure while handling T2LM Action Frame in WLAN Host.
• CVE-2025-21433 — CVSS 6.2 (medium): Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
• CVE-2023-43530 — CVSS 5.9 (medium): Memory corruption in HLOS while checking for the storage type.
• CVE-2024-43051 — CVSS 5.5 (medium): Information disclosure while deriving keys for a session for any Widevine use case.
• CVE-2024-53009 — CVSS 5.3 (medium): Memory corruption while operating the mailbox in Automotive.