{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Qualcomm vulnerabilities","home_page_url":"https://patchfirst.co/vendor/qualcomm/","feed_url":"https://patchfirst.co/feed/vendor/qualcomm.json","description":"New and newly exploited Qualcomm CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-21385#kev","url":"https://patchfirst.co/cve/CVE-2026-21385/","title":"[KEV] CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2026-03-03. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 67.6 of 100.","summary":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability","date_published":"2026-03-03T00:00:00.000Z","date_modified":"2026-06-17T10:18:36.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2026-03-03","ransomware":false},"epss":{"score":0.01316,"percentile":0.70731},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-21479#kev","url":"https://patchfirst.co/cve/CVE-2025-21479/","title":"[KEV] CVE-2025-21479: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2025-06-03. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 56% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 60.2 of 100.","summary":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","date_published":"2025-06-03T00:00:00.000Z","date_modified":"2026-06-17T08:43:33.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":60.2,"kev":{"dateAdded":"2025-06-03","ransomware":false},"epss":{"score":0.00783,"percentile":0.55989},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-27038#kev","url":"https://patchfirst.co/cve/CVE-2025-27038/","title":"[KEV] CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2025-06-03. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 64.1% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1203 Exploitation for Client Execution; T1059 Command and Scripting Interpreter. Priority 56.1 of 100.","summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","date_published":"2025-06-03T00:00:00.000Z","date_modified":"2026-06-17T09:02:48.000Z","tags":["kev","T1203","T1059"],"_patchfirst":{"reason":"kev","priority":56.1,"kev":{"dateAdded":"2025-06-03","ransomware":false},"epss":{"score":0.01044,"percentile":0.64082},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1203","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-21480#kev","url":"https://patchfirst.co/cve/CVE-2025-21480/","title":"[KEV] CVE-2025-21480: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2025-06-03. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 37.1% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1055 Process Injection; T1495 Firmware Corruption. Priority 51.4 of 100.","summary":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","date_published":"2025-06-03T00:00:00.000Z","date_modified":"2026-06-17T08:43:33.000Z","tags":["kev","T1055","T1495"],"_patchfirst":{"reason":"kev","priority":51.4,"kev":{"dateAdded":"2025-06-03","ransomware":false},"epss":{"score":0.00428,"percentile":0.37119},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1055","T1495"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-45569","url":"https://patchfirst.co/cve/CVE-2024-45569/","title":"CVE-2024-45569: Improper Validation of Array Index in WLAN Host Communication","content_text":"Qualcomm, Inc. · Snapdragon. Not in CISA KEV. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 9.8 CRITICAL. Priority 51.4 of 100.","summary":"Improper Validation of Array Index in WLAN Host Communication","date_published":"2025-02-03T00:00:00.000Z","date_modified":"2026-02-26T19:09:25.000Z","tags":[],"_patchfirst":{"reason":"published","priority":51.4,"kev":null,"epss":{"score":0.00576,"percentile":0.47497},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Qualcomm, Inc.","product":"Snapdragon","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-43047#kev","url":"https://patchfirst.co/cve/CVE-2024-43047/","title":"[KEV] CVE-2024-43047: Qualcomm Multiple Chipsets Use-After-Free Vulnerability","content_text":"Qualcomm · Multiple Chipsets . In CISA KEV since 2024-10-08. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 53.9 of 100.","summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2026-06-17T07:50:18.000Z","tags":["kev","T1068"],"_patchfirst":{"reason":"kev","priority":53.9,"kev":{"dateAdded":"2024-10-08","ransomware":false},"epss":{"score":0.00674,"percentile":0.52126},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets ","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33107#kev","url":"https://patchfirst.co/cve/CVE-2023-33107/","title":"[KEV] CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2023-12-05. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 59.4 of 100.","summary":"Qualcomm Multiple Chipsets Integer Overflow Vulnerability","date_published":"2023-12-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:58.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":59.4,"kev":{"dateAdded":"2023-12-05","ransomware":false},"epss":{"score":0.00739,"percentile":0.5453},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-33106#kev","url":"https://patchfirst.co/cve/CVE-2023-33106/","title":"[KEV] CVE-2023-33106: Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2023-12-05. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 56.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 54.7 of 100.","summary":"Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability","date_published":"2023-12-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:56.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":54.7,"kev":{"dateAdded":"2023-12-05","ransomware":false},"epss":{"score":0.00788,"percentile":0.56165},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33063#kev","url":"https://patchfirst.co/cve/CVE-2023-33063/","title":"[KEV] CVE-2023-33063: Qualcomm Multiple Chipsets Use-After-Free Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2023-12-05. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1203 Exploitation for Client Execution. Priority 53.9 of 100.","summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","date_published":"2023-12-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:38.000Z","tags":["kev","T1068","T1203"],"_patchfirst":{"reason":"kev","priority":53.9,"kev":{"dateAdded":"2023-12-05","ransomware":false},"epss":{"score":0.00672,"percentile":0.52057},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1068","T1203"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-22071#kev","url":"https://patchfirst.co/cve/CVE-2022-22071/","title":"[KEV] CVE-2022-22071: Qualcomm Multiple Chipsets Use-After-Free Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2023-12-05. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 35.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 50.5 of 100.","summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","date_published":"2023-12-05T00:00:00.000Z","date_modified":"2026-06-17T04:27:37.000Z","tags":["kev","T1068"],"_patchfirst":{"reason":"kev","priority":50.5,"kev":{"dateAdded":"2023-12-05","ransomware":false},"epss":{"score":0.00411,"percentile":0.35304},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-11261#kev","url":"https://patchfirst.co/cve/CVE-2020-11261/","title":"[KEV] CVE-2020-11261: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability","content_text":"Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.8% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 58.6 of 100.","summary":"Qualcomm Multiple Chipsets Improper Input Validation Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T02:49:49.000Z","tags":["kev","T1068"],"_patchfirst":{"reason":"kev","priority":58.6,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.01604,"percentile":0.75824},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-1905#kev","url":"https://patchfirst.co/cve/CVE-2021-1905/","title":"[KEV] CVE-2021-1905: Qualcomm Multiple Chipsets Use-After-Free Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 74.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1203 Exploitation for Client Execution; T1068 Exploitation for Privilege Escalation. Priority 58.4 of 100.","summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:32:47.000Z","tags":["kev","T1203","T1068"],"_patchfirst":{"reason":"kev","priority":58.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.01543,"percentile":0.74932},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1203","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-1906#kev","url":"https://patchfirst.co/cve/CVE-2021-1906/","title":"[KEV] CVE-2021-1906: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 0.5% (higher than 44.1% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499 Endpoint Denial of Service. Priority 50.7 of 100.","summary":"Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:32:48.000Z","tags":["kev","T1068","T1499"],"_patchfirst":{"reason":"kev","priority":50.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.0052,"percentile":0.44148},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1068","T1499"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}