Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-10672

Summary
Assigner-zephyr
Assigner Org ID-e2e69745-5e70-4e92-8431-deb5529a81ad
Published At-14 Jul, 2026 | 15:02
Updated At-14 Jul, 2026 | 18:38
Rejected At-
Credits

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:zephyr
Assigner Org ID:e2e69745-5e70-4e92-8431-deb5529a81ad
Published At:14 Jul, 2026 | 15:02
Updated At:14 Jul, 2026 | 18:38
Rejected At:
â–¼CVE Numbering Authority (CNA)
Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.

Affected Products
Vendor
Zephyr Projectzephyrproject
Product
zephyr
Collection URL
https://github.com/zephyrproject-rtos/zephyr
Package Name
zephyr
Program Files
  • subsys/net/lib/lwm2m/lwm2m_pull_context.c
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 4.5.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-125bounds
Type: CWE
CWE ID: CWE-125
Description: bounds
Metrics
VersionBase scoreBase severityVector
3.18.2HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2
patch
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
N/A
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2
Resource:
patch
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
exploit
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
Resource:
exploit
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:vulnerabilities@zephyrproject.org
Published At:14 Jul, 2026 | 15:16
Updated At:14 Jul, 2026 | 19:16

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.2HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
N/A
Type: Secondary
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-125Secondaryvulnerabilities@zephyrproject.org
CWE ID: CWE-125
Type: Secondary
Source: vulnerabilities@zephyrproject.org
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2vulnerabilities@zephyrproject.org
N/A
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mfvulnerabilities@zephyrproject.org
N/A
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf134c704f-9b21-4f2e-91b3-4a467353bcc0
N/A
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2
Source: vulnerabilities@zephyrproject.org
Resource: N/A
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
Source: vulnerabilities@zephyrproject.org
Resource: N/A
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

65Records found
CVE-2022-33284
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-06 Jan, 2023 | 05:02
Updated-09 Apr, 2025 | 15:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-sd_8cx_gen3_firmwareqca2066sm6250p_firmwareqca8337ar9380ipq8173_firmwareqca6431_firmwaresdx65qcn5124qca4024_firmwarewcn3950_firmwareipq8078aipq5028_firmwareqca6595au_firmwareqca2062sd_675_firmwaresm4375wcn3998qca6554a_firmwareqam8295pwcn3950qcn6024_firmwaresd720gsm4125sd_8cx_gen2_firmwareipq8076aqca8386_firmwaresd_8_gen1_5g_firmwareqca8084_firmwareqsm8350_firmwareqsm8350sd460_firmwaresm7315_firmwarewcn7850qca6574au_firmwareqcn5164_firmwarewcd9375_firmwareqca8081_firmwarewcn3998_firmwareqca6420qcn9002qca9986sd680_firmwareipq8070_firmwareipq8065ipq8078a_firmwaresd_8cx_gen2qrb5165_firmwareipq5028qrb5165m_firmwareipq6010sd662_firmwareipq8068qca6430wcd9340qcn6132sd765gsw5100sd680qca6436wcn6851wcn7851_firmwareqca9888_firmwareqcn6122wcd9341ipq8068_firmwareqca2066_firmwareqca6696_firmwareqca6431sd870_firmwaresd750gipq9008_firmwareqcn5154_firmwarewcn3910_firmwaresxr2150p_firmwarewsa8830_firmwareqca9992_firmwaresd865_5g_firmwaresd855_firmwarewcn3988wcn7850_firmwaresm8475qcn5022_firmwarewcn6750_firmwaresa8295p_firmwareipq5018_firmwareqca9985_firmwarewcn3991qca8337_firmwarewcd9380_firmwareipq8072aqca9980_firmwaresw5100pipq8076a_firmwareipq8078qca8084qcn9001_firmwareipq8173sdx55m_firmwareqca6564auwcn6856_firmwareipq9008qcn5164qca6574csr8811_firmwarewcd9380qcn5054_firmwareqcn5024sd690_5g_firmwaresdx50m_firmwareqca8072_firmwareqca9985qcn9012_firmwareqca6430_firmwareqcn9274_firmwareqcn5052_firmwarewcd9335_firmwarewcn3980ipq6018_firmwarewcd9340_firmwarewsa8815wcn6850sd7cpmp8074_firmwareqcn6112wcn3910qca9986_firmwareqca6426_firmwaresd695ipq6028ipq8064qca9984pmp8074qcn9024ipq9574_firmwarewcn3980_firmwaresd730sdx55mipq8064_firmwareqcc5100_firmwaresa8295pqca6421_firmwareqca2062_firmwarewcn6740_firmwaresd678_firmwareipq8078_firmwareqcn5054qrb5165wcn6851_firmwareipq8070qca9994qca9980qcn9024_firmwareipq8174_firmwaresd480sd870wcn6855sw5100p_firmwareipq6018qca9886_firmwaresd695_firmwareqca6595_firmwareqca6391_firmwareqca4024wcd9370_firmwareqca2064sd780g_firmwaresdx55sd888_firmwareqcn5021_firmwaresd675sxr2150par8035_firmwareqcn5024_firmwarewcn3991_firmwarewsa8830sd678qcn9070sd7c_firmwareqca8082qcn9072qca8386qca9992sd765g_firmwareqca6420_firmwareqca6390_firmwareqca2064_firmwaresd690_5gipq6000sd730_firmwarewcd9370sd675_firmwareqcn5152_firmwareqca6426qca6584au_firmwarewcn3990_firmwareqrb5165n_firmwareqcn9000_firmwareqca9984_firmwareipq5018wcd9385_firmwaresdxr2_5g_firmwarewcd9326_firmwareipq8074aqca2065sd662qcn5124_firmwareqam8295p_firmwareqcn6102_firmwareqcn9011_firmwareqcn6100_firmwareqca8082_firmwareqcn5122_firmwaresdx55_firmwareqca6595auqcn6023_firmwaresm7250p_firmwareqca6436_firmwareqrb5165nipq5010qca6564au_firmwareqca6584ausd778gqcn9274ipq8174wcn7851qcn9001qca9990qcs6490qcn5052sdxr2_5gqcn6112_firmwarewcn3988_firmwareqcn9074qca6421qca8085sd778g_firmwaresm6250wsa8810_firmwaresm4375_firmwaresd765_firmwarewcd9326wcd9335qca8081qcn6023ipq8071aipq8071a_firmwarewcd9385qca8085_firmwareqcs6490_firmwareqca2065_firmwaresd_8cx_gen3qca6390wcd9375sd750g_firmwareaqt1000ar8035csr8811sm6250_firmwareqcn9100_firmwareipq5010_firmwareipq8074a_firmwaresd888_5g_firmwarewsa8815_firmwareqcm6490wcn6850_firmwarewsa8835_firmwareqca8072wcn3990qcn9000sd_675sd780gqca6554asd865_5gqca6595ar9380_firmwareqcc5100qcn9012sd888qcn6122_firmwareipq8065_firmwarewsa8835sd888_5gsm6250pqcn5154qca8075_firmwaresc8180xqca6574awcn6855_firmwareqca9889sm7325pqcn6132_firmwareqcn9003_firmwareqca9888qca9994_firmwarewcn6750qcn9003ipq8070a_firmwareipq8076_firmwareqca6574_firmwareqca9886sd855sm4125_firmwaresm7325p_firmwareipq8076sd765qca6574a_firmwareqcn5021sd768g_firmwareqcn5152qrb5165msm7315sd460qca6391aqt1000_firmwareqcn6102qcn9100sdx65_firmwareqcm6490_firmwaresdx50mqcn9070_firmwaresd480_firmwareipq6028_firmwareipq8072a_firmwareqcn9011sc8180x_firmwareqca6574auqca9889_firmwareqcn5122ipq9574wcd9341_firmwarewsa8810wcn6856qcn5022sd768gipq6010_firmwarewcn6740qca6696qca8075qcn9022_firmwareqcn6024qcn9022qca9990_firmwareipq8070aqcn9002_firmwareqcn6100qcn9072_firmwaresm7250pipq6000_firmwaresd720g_firmwaresw5100_firmwareqcn9074_firmwareSnapdragon
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-33295
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-03 Aug, 2024 | 08:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in Modem

Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-mdm9206wcd9306snapdragon_wear_1300mdm8207snapdragon_wear_1200wcd9330mdm9207snapdragon_x5_lte_modem_firmwaremdm8207_firmwaresnapdragon_wear_1100mdm9205_firmwaremdm9205qca4004_firmwaremdm9206_firmwaremdm9207_firmwareqca4004qts110wcd9306_firmwaresnapdragon_wear_1100_firmwaresnapdragon_wear_1300_firmwarewcd9330_firmwaresnapdragon_wear_1200_firmwaresnapdragon_x5_lte_modemqts110_firmwareSnapdragon
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-33252
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.24% / 15.57%
||
7 Day CHG~0.00%
Published-06 Jan, 2023 | 05:02
Updated-09 Apr, 2025 | 19:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-sd_8cx_gen3_firmwareqca2066sa6150p_firmwareqca8337ar9380ipq8173_firmwareqca6431_firmwarewcd9360_firmwaresdx65qcn5124qca4024_firmwaresc8180x\+sdx55ipq8078aipq5028_firmwaresa8150p_firmwareqca6595au_firmwaresa6155qca2062sa415mwcn3998qca6554a_firmwareqam8295psd_8cx_gen2_firmwareqcn6024_firmwareipq8076aqca8386_firmwaresd_8_gen1_5g_firmwareqca8084_firmwareqsm8350_firmwareqsm8350sm7315_firmwarewcn7850qca6574au_firmwareqcn5164_firmwarewcd9375_firmwareqca8081_firmwarewcn3998_firmwaresa6155_firmwareqca6420wcd9360qcn9002qca9986ipq8070_firmwareipq8065ipq8078a_firmwaresd_8cx_gen2qrb5165_firmwareipq5028qrb5165m_firmwaresa8155_firmwareipq6010ipq8068qca6430wcd9340qcn6132qca6436wcn6851sa6155pwcn7851_firmwareqca9888_firmwareqcn6122wcd9341ipq8068_firmwareqca2066_firmwareqca6696_firmwareqca6431sd870_firmwareqca1062ipq9008_firmwareqcn5154_firmwaresxr2150p_firmwaresa8150pwsa8830_firmwareqca9992_firmwaresd865_5g_firmwarewcn7850_firmwaresa8195p_firmwaresm8475qcn5022_firmwarewcn6750_firmwaresa8295p_firmwareipq5018_firmwareqca9985_firmwareqca8337_firmwarewcd9380_firmwareipq8072aqca9980_firmwareipq8076a_firmwareipq8078qca8084qcn9001_firmwareipq8173sdx55m_firmwareqca6564auwcn6856_firmwareipq9008qcn5164qca6574csr8811_firmwarewcd9380qcn5054_firmwareqcn5024qca8072_firmwareqca9985qcn9012_firmwareqca6430_firmwareqcn9274_firmwareqcn5052_firmwarewcn3980ipq6018_firmwarewcd9340_firmwarewsa8815wcn6850pmp8074_firmwareqcn6112qca9986_firmwareqca6426_firmwareqca9984ipq6028ipq8064qcn9024pmp8074ipq9574_firmwarewcn3980_firmwaresdx55mipq8064_firmwaresa8295pqca6421_firmwareqca2062_firmwarewcn6740_firmwareipq8078_firmwareqcn5054qrb5165wcn6851_firmwareipq8070qca9994qca9980qcn9024_firmwareipq8174_firmwaresd870wcn6855qsm8250sa6145pipq6018qca9886_firmwareqca6595_firmwaresa8145pqca6391_firmwaresa4150p_firmwareqca4024wcd9370_firmwareqca2064sd780g_firmwaresdx55sd888_firmwareqcn5021_firmwaresa8155psxr2150par8035_firmwareqsm8250_firmwareqcn5024_firmwarewsa8830qcn9070sa8145p_firmwareqca1062_firmwarecsrb31024qca8082qcn9072qca8386qca9992qca6420_firmwareqca6390_firmwareqca2064_firmwareipq6000wcd9370qcn5152_firmwareqca6426qca6584au_firmwareqrb5165n_firmwareqcn9000_firmwareqca9984_firmwareipq5018wcd9385_firmwaresdxr2_5g_firmwareipq8074aqca2065qcn5124_firmwareqam8295p_firmwareqcn6102_firmwareqcn9011_firmwareqca1064sa8155qcn6100_firmwareqca8082_firmwareqcn5122_firmwaresdx55_firmwareqca6595auqcn6023_firmwareqca6436_firmwareqrb5165nipq5010qca6564au_firmwareqca6584ausd778gsa6155p_firmwareqcn9274ipq8174wcn7851qcn9001qca9990qcs6490qcn5052sa515m_firmwaresdxr2_5gqcn6112_firmwaresa415m_firmwareqcn9074sa6145p_firmwareqca6421qca8085sd778g_firmwaresa8195pwsa8810_firmwareqca8081qcn6023ipq8071aipq8071a_firmwarewcd9385qca8085_firmwareqcs6490_firmwareqca2065_firmwaresd_8cx_gen3qca6390wcd9375ar8035aqt1000csr8811sc8180x\+sdx55_firmwareqcn9100_firmwareipq5010_firmwareipq8074a_firmwaresd888_5g_firmwarewsa8815_firmwareqcm6490wcn6850_firmwarewsa8835_firmwareqcx315sa4150pqca8072qcn9000sd780gqca6554asd865_5gqca6595ar9380_firmwareqcn9012sd888qcn6122_firmwareipq8065_firmwareqcx315_firmwarewsa8835sd888_5gqcn5154qca8075_firmwareqca6574awcn6855_firmwareqca9889sm7325pqcn6132_firmwareqcn9003_firmwareqca9888qca9994_firmwarewcn6750qcn9003ipq8070a_firmwareipq8076_firmwaresa515mqca6574_firmwareqca9886sm7325p_firmwareipq8076qca6574a_firmwareqcn5021qcn5152qrb5165msm7315qca6391aqt1000_firmwareqcn6102qcn9100sdx65_firmwarecsrb31024_firmwareqcm6490_firmwareqcn9070_firmwareipq6028_firmwareipq8072a_firmwareqcn9011qca6574auqca9889_firmwaresa8155p_firmwareqcn5122ipq9574wcd9341_firmwarewsa8810wcn6856qcn5022ipq6010_firmwareqca1064_firmwarewcn6740qca6696sa6150pqca8075qcn9022_firmwareqcn6024qcn9022qca9990_firmwareipq8070aqcn9002_firmwareqcn6100qcn9072_firmwareipq6000_firmwareqcn9074_firmwareSnapdragon
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-33283
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-06 Jan, 2023 | 05:02
Updated-09 Apr, 2025 | 15:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-sd_8cx_gen3_firmwareqca2066qca8337ar9380qca6431_firmwareipq8173_firmwaresdx65qcn5124qca4024_firmwareipq8078aipq5028_firmwareqca6595au_firmwareqca2062qca6554a_firmwareqam8295pipq8076aqca8386_firmwareqcn6024_firmwaresd_8_gen1_5g_firmwareqca8084_firmwareqsm8350_firmwareqsm8350sm7315_firmwarewcn7850qca6574au_firmwareqcn5164_firmwarewcd9375_firmwareqca8081_firmwareqcn9002qca9986ipq8070_firmwareipq8065ipq8078a_firmwareqrb5165_firmwareipq5028qrb5165m_firmwareipq6010ipq8068qcn6132qca6436wcn6851wcn7851_firmwareqca9888_firmwareqcn6122ipq8068_firmwareqca2066_firmwareqca6431qca6696_firmwaresd870_firmwareipq9008_firmwareqcn5154_firmwaresxr2150p_firmwarewsa8830_firmwareqca9992_firmwaresd865_5g_firmwarewcn7850_firmwaresm8475qcn5022_firmwaresa8295p_firmwarewcn6750_firmwareipq5018_firmwareqca9985_firmwareqca8337_firmwarewcd9380_firmwareipq8072aqca9980_firmwareipq8076a_firmwareipq8078qca6564auqca8084ipq8173qcn9001_firmwaresdx55m_firmwareipq9008wcn6856_firmwareqcn5164qca6574csr8811_firmwarewcd9380qcn5054_firmwareqcn5024qca8072_firmwareqca9985qcn9012_firmwareqcn5052_firmwareqcn9274_firmwarewcn3980ipq6018_firmwarewsa8815wcn6850pmp8074_firmwareqcn6112qca9986_firmwareqca6426_firmwareqca9984ipq6028ipq8064qcn9024pmp8074ipq9574_firmwarewcn3980_firmwaresdx55mipq8064_firmwaresa8295pqca6421_firmwareqca2062_firmwarewcn6740_firmwareipq8078_firmwareqcn5054qrb5165wcn6851_firmwareipq8070qca9994qca9980qcn9024_firmwareipq8174_firmwaresd870wcn6855ipq6018qca9886_firmwareqca6595_firmwareqca6391_firmwareqca2064qca4024sd780g_firmwarewcd9370_firmwaresd888_firmwareqcn5021_firmwaresxr2150par8035_firmwareqcn5024_firmwarewsa8830qcn9070qca8082qcn9072qca8386qca9992qca6390_firmwareqca2064_firmwareipq6000wcd9370qcn5152_firmwareqca6426qca6584au_firmwareqrb5165n_firmwareqcn9000_firmwareqca9984_firmwareipq5018wcd9385_firmwaresdxr2_5g_firmwareipq8074aqca2065qcn5124_firmwareqam8295p_firmwareqcn6100_firmwareqcn6102_firmwareqcn9011_firmwareqca8082_firmwareqcn5122_firmwareqca6595auqcn6023_firmwareqca6436_firmwareqrb5165nipq5010qca6564au_firmwareqca6584ausd778gqcn9274ipq8174qca9990qcn9001qcs6490sdxr2_5gqcn5052wcn7851qcn6112_firmwareqcn9074qca6421qca8085sd778g_firmwarewsa8810_firmwareqca8081ipq8071aqcn6023ipq8071a_firmwarewcd9385qca8085_firmwareqca2065_firmwareqcs6490_firmwaresd_8cx_gen3ar8035csr8811qca6390wcd9375qcn9100_firmwareipq5010_firmwareipq8074a_firmwareqcm6490sd888_5g_firmwarewcn6850_firmwarewsa8815_firmwarewsa8835_firmwareqca8072qcn9000sd780gqca6554asd865_5gqca6595ar9380_firmwareqcn9012sd888qcn6122_firmwareipq8065_firmwarewsa8835sd888_5gqcn5154qca8075_firmwareqca6574awcn6855_firmwareqca9889sm7325pqcn6132_firmwareqcn9003_firmwareqca9888qca9994_firmwarewcn6750qcn9003ipq8070a_firmwareipq8076_firmwareqca6574_firmwareqca9886sm7325p_firmwareipq8076qca6574a_firmwareqcn5021qcn5152qrb5165msm7315qca6391qcn6102qcn9100sdx65_firmwareqcm6490_firmwareqcn9070_firmwareipq6028_firmwareipq8072a_firmwareqcn9011qca6574auqca9889_firmwareipq9574qcn5122wsa8810wcn6856qcn5022ipq6010_firmwarewcn6740qca6696qca8075qcn9022_firmwareqcn6024qcn9022qca9990_firmwareipq8070aqcn9002_firmwareqcn6100qcn9072_firmwareipq6000_firmwareqcn9074_firmwareSnapdragon
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-33287
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-03 Aug, 2024 | 08:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in Modem

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-snapdragon_1100_wearable_platformwsa8830wcd9380_firmwaressg2125psxr2230p_firmware9207_lte_modemwcd9330wcn785x-59205_lte_modemcsra6620qca4024_firmwarewsa8835sxr1230p_firmwarewcd9380snapdragon_wear_1300_platformcsra6620_firmwarehome_hub_100_platformssg2125p_firmwaressg2115pcsra6640_firmwarewcn685x-5_firmwaresxr1230pwcn685x-1qcs400_firmwarewcd9335_firmwarewcn3980wcn3998wcd9385_firmwaresnapdragon_1200_wearable_platform_firmwarewsa8815sxr2230pwcn3999_firmwarewcn3998_firmwarewcn785x-5_firmwarewcn3980_firmwarewcd9330_firmware9205_lte_modem_firmwarewcd9306mdm8207wcn3999snapdragon_x5_lte_modem_firmwarear8031_firmwarewsa8832_firmware9206_lte_modemwcn685x-5qca4004_firmware9206_lte_modem_firmwarewcn785x-1_firmwareqts110wcd9306_firmwarewsa8810_firmwarewsa8810home_hub_100_platform_firmwarewsa8832snapdragon_ar2_gen_1_platform_firmwarewcd9335qca4010snapdragon_ar2_gen_1_platformwcn685x-1_firmwaresnapdragon_wear_1300_platform_firmwarewcd93859207_lte_modem_firmwarear8031mdm8207_firmwareqca4024snapdragon_1100_wearable_platform_firmwareqca4004wsa8830_firmwarecsra6640wsa8815_firmwarewsa8835_firmwaressg2115p_firmwaresnapdragon_1200_wearable_platformqcs400qca4010_firmwarewcn785x-1snapdragon_x5_lte_modemqts110_firmwareSnapdragon9205_lte_modem_firmwarewcd9380_firmwaresxr2230p_firmwaresmart_audio_400_platform_firmwarear8031_firmwaresnapdragon_x5_lte_modem_firmwarewsa8832_firmwarefastconnect_6900_firmwareqca4004_firmware9206_lte_modem_firmwareqca4024_firmwarewcd9306_firmwaresxr1230p_firmwarewsa8810_firmwarefastconnect_7800_firmwarehome_hub_100_platform_firmwaresnapdragon_ar2_gen_1_platform_firmwarecsra6620_firmwaressg2125p_firmwarecsra6640_firmwaresnapdragon_wear_1300_platform_firmware9207_lte_modem_firmwarewcd9335_firmwaremdm8207_firmwarewcd9385_firmwaresnapdragon_1200_wearable_platform_firmwaresnapdragon_1100_wearable_platform_firmwarewsa8830_firmwarewsa8815_firmwarewsa8835_firmwarefastconnect_6200_firmwaressg2115p_firmwarewcn3999_firmwarewcn3980_firmwarewcd9330_firmwareqca4010_firmwareqts110_firmware
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-33291
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-03 Aug, 2024 | 08:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer over-read in Modem

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-snapdragon_1100_wearable_platformwsa8830wcd9380_firmwaressg2125psxr2230p_firmware9207_lte_modemwcd9330wcn785x-59205_lte_modemcsra6620qca4024_firmwarewsa8835sxr1230p_firmwarewcd9380snapdragon_wear_1300_platformcsra6620_firmwarehome_hub_100_platformssg2125p_firmwaressg2115pcsra6640_firmwarewcn685x-5_firmwaresxr1230pwcn685x-1qcs400_firmwarewcd9335_firmwarewcn3980wcn3998wcd9385_firmwaresnapdragon_1200_wearable_platform_firmwarewsa8815sxr2230pwcn3999_firmwarewcn3998_firmwarewcn785x-5_firmwarewcn3980_firmwarewcd9330_firmware9205_lte_modem_firmwarewcd9306mdm8207wcn3999snapdragon_x5_lte_modem_firmwarear8031_firmwarewsa8832_firmware9206_lte_modemwcn685x-5qca4004_firmware9206_lte_modem_firmwarewcn785x-1_firmwareqts110wcd9306_firmwarewsa8810_firmwarewsa8810home_hub_100_platform_firmwarewsa8832snapdragon_ar2_gen_1_platform_firmwarewcd9335qca4010snapdragon_ar2_gen_1_platformwcn685x-1_firmwaresnapdragon_wear_1300_platform_firmwarewcd93859207_lte_modem_firmwarear8031mdm8207_firmwareqca4024snapdragon_1100_wearable_platform_firmwareqca4004wsa8830_firmwarecsra6640wsa8815_firmwarewsa8835_firmwaressg2115p_firmwaresnapdragon_1200_wearable_platformqcs400qca4010_firmwarewcn785x-1snapdragon_x5_lte_modemqts110_firmwareSnapdragon9205_lte_modem_firmwarewcd9380_firmwaresxr2230p_firmwaresmart_audio_400_platform_firmwarear8031_firmwaresnapdragon_x5_lte_modem_firmwarewsa8832_firmwarefastconnect_6900_firmwareqca4004_firmware9206_lte_modem_firmwareqca4024_firmwarewcd9306_firmwaresxr1230p_firmwarewsa8810_firmwarefastconnect_7800_firmwarehome_hub_100_platform_firmwaresnapdragon_ar2_gen_1_platform_firmwarecsra6620_firmwaressg2125p_firmwarecsra6640_firmwaresnapdragon_wear_1300_platform_firmware9207_lte_modem_firmwarewcd9335_firmwaremdm8207_firmwarewcd9385_firmwaresnapdragon_1200_wearable_platform_firmwaresnapdragon_1100_wearable_platform_firmwarewsa8830_firmwarewsa8815_firmwarewsa8835_firmwarefastconnect_6200_firmwaressg2115p_firmwarewcn3999_firmwarewcn3980_firmwarewcd9330_firmwareqca4010_firmwareqts110_firmware
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25747
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-11 Feb, 2025 | 14:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer Over-read in MODEM

Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-mdm9206wcd9306snapdragon_wear_1300mdm8207snapdragon_wear_1200wcd9330mdm9207snapdragon_x5_lte_modem_firmwaremdm8207_firmwaresnapdragon_wear_1100mdm9205_firmwaremdm9205qca4004_firmwaremdm9206_firmwaremdm9207_firmwareqca4004qts110wcd9306_firmwaresnapdragon_wear_1100_firmwaresnapdragon_wear_1300_firmwarewcd9330_firmwaresnapdragon_wear_1200_firmwaresnapdragon_x5_lte_modemqts110_firmwareSnapdragon
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25730
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-03 Aug, 2024 | 04:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer Over-read in MODEM

Information disclosure in modem due to improper check of IP type while processing DNS server query

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-wcd9306wcd9380_firmwarewsa8830snapdragon_wear_1300ssg2125psxr2230p_firmwaremdm8207snapdragon_wear_1200wcd9330snapdragon_x5_lte_modem_firmwarewsa8832_firmwarewcn785x-5wcn685x-5qca4004_firmwarewcn785x-1_firmwareqts110wcd9306_firmwaresxr1230p_firmwarewsa8835wcd9380wsa8832snapdragon_ar2_gen_1_platform_firmwaresnapdragon_wear_1100_firmwareqca4010snapdragon_wear_1200_firmwaressg2125p_firmwaressg2115psnapdragon_ar2_gen_1_platformmdm9206wcn685x-5_firmwarewcn685x-1_firmwaresxr1230pwcd9385wcn685x-1snapdragon_x5_lte_modemmdm8207_firmwaresnapdragon_wear_1100mdm9205_firmwarewcd9385_firmwaremdm9205mdm9206_firmwaremdm9207_firmwareqca4004sxr2230pwsa8830_firmwarewsa8835_firmwaressg2115p_firmwaresnapdragon_wear_1300_firmwarewcn785x-5_firmwarewcd9330_firmwareqca4010_firmwarewcn785x-1mdm9207qts110_firmwareSnapdragonfastconnect_7800wcd9306snapdragon_1100_wearable_platformwsa8830sxr1230pssg2125pwcd93859207_lte_modemmdm8207wcd93309206_lte_modemfastconnect_6900snapdragon_ar2_gen1_platform9205_lte_modemqca4004sxr2230pqts110wsa8835wcd9380wsa8832snapdragon_1200_wearable_platformsnapdragon_x5_lte_firmwareqca4010snapdragon_wear_1300_platformssg2115p
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25738
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.38% / 29.90%
||
7 Day CHG~0.00%
Published-09 Feb, 2023 | 06:58
Updated-03 Aug, 2024 | 04:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer Over-read in MODEM

Information disclosure in modem due to buffer over-red while performing checksum of packet received

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-wcd9380_firmwarewsa8830ssg2125psxr2230p_firmwarewcd9330wcn6856_firmwarecsra6620qca4024_firmwarewsa8835sxr1230p_firmwarewcd9380csra6620_firmwaressg2125p_firmwaressg2115pmdm9206csra6640_firmwarewcn6855_firmwaresxr1230pwcd9335_firmwarewcn3980wcn3998wcd9385_firmwaremdm9205mdm9206_firmwarewsa8815sxr2230pqca4020wcn7850wcn3999_firmwarewcn3998_firmwarewcn3980_firmwarewcd9330_firmwaremdm9207wcd9306mdm8207wcn3999wcn7851ar8031_firmwarewsa8832_firmwareqca4004_firmwaremdm9607_firmwareqcs405qts110mdm9607wcd9306_firmwarewsa8810_firmwarewsa8810wsa8832qca4020_firmwarewcn6855wcd9335qca4010wcn7851_firmwarewcn6856wcd9385ar8031qcs405_firmwaremdm8207_firmwaremdm9205_firmwareqca4024mdm9207_firmwareqca4004csra6640wsa8830_firmwarewsa8815_firmwarewsa8835_firmwarewcn7850_firmwaressg2115p_firmwareqca4010_firmwareqts110_firmwareSnapdragon
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25728
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.38% / 29.90%
||
7 Day CHG~0.00%
Published-09 Feb, 2023 | 06:58
Updated-03 Aug, 2024 | 04:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer Over-read in MODEM

Information disclosure in modem due to buffer over-read while processing response from DNS server

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-wcd9380_firmwarewsa8830ssg2125psxr2230p_firmwarewcd9330wcn6856_firmwarecsra6620qca4024_firmwarewsa8835sxr1230p_firmwarewcd9380csra6620_firmwaressg2125p_firmwaressg2115pmdm9206csra6640_firmwarewcn6855_firmwaresxr1230pwcd9335_firmwarewcn3980wcn3998wcd9385_firmwaremdm9205mdm9206_firmwarewsa8815sxr2230pqca4020wcn7850wcn3999_firmwarewcn3998_firmwarewcn3980_firmwarewcd9330_firmwaremdm9207wcd9306mdm8207wcn3999wcn7851ar8031_firmwarewsa8832_firmwareqca4004_firmwaremdm9607_firmwareqcs405qts110mdm9607wcd9306_firmwarewsa8810_firmwarewsa8810wsa8832qca4020_firmwarewcn6855wcd9335wcn7851_firmwarewcn6856wcd9385ar8031qcs405_firmwaremdm8207_firmwaremdm9205_firmwareqca4024mdm9207_firmwareqca4004csra6640wsa8830_firmwarewsa8815_firmwarewsa8835_firmwarewcn7850_firmwaressg2115p_firmwareqts110_firmwareSnapdragonwcd9380_firmwaresxr2230p_firmwarear8031_firmwarewsa8832_firmwarewcn6856_firmwareqca4004_firmwaremdm9607_firmwareqca4024_firmwarewcd9306_firmwaresxr1230p_firmwarewsa8810_firmwareqca4020_firmwaressg2125p_firmwarecsra6620_firmwarewcn7851_firmwarewcn6855_firmwarecsra6640_firmwareqcs405_firmwarewcd9335_firmwaremdm8207_firmwaremdm9205_firmwarewcd9385_firmwaremdm9206_firmwaremdm9207_firmwarewsa8830_firmwarewsa8815_firmwarewsa8835_firmwarewcn7850_firmwaressg2115p_firmwarewcn3999_firmwarewcn3998_firmwarewcn3980_firmwarewcd9330_firmwareqts110_firmware
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25719
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.46% / 37.37%
||
7 Day CHG~0.00%
Published-19 Oct, 2022 | 00:00
Updated-09 May, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-qcn9022wcn3660mdm9225_firmwareqcn5022_firmwaresd210_firmwarewcd9340_firmwaremsm8917_firmwarewcd9306_firmwareqcn6024sd439apq8084qca4004_firmwareipq8078apq8056_firmwaremdm9230_firmwaremdm9205_firmwareqca6174sdw2500sd210sd205_firmwareqcn5124msm8976sg_firmwareqcn5024wcn3980ipq8072a_firmwareqca1990_firmwaremsm8940_firmwareqcn9000ipq5028mdm9625mmsm8920_firmwareqcn9072apq8052wcn3620_firmwareqcn5052_firmwareipq5028_firmwarewcd9340qca1990qca6174a_firmwareqcn5122ipq8074a_firmwaremdm9630_firmwareipq8078a_firmwareapq8056ipq8076a_firmwareipq8070a_firmwareqcn6122wcn3999apq8017qcn5154wcd9326apq8009w_firmwareipq8076asdm429wipq8076sdw2500_firmwaremdm9205ipq8071a_firmwarewcn3680bwcn3680_firmwarequalcomm215_firmwareqet4101_firmwarewcn3660bwsa8810ipq6010pm8937csr8811_firmwaremsm8208_firmwarear8031apq8076csra6640msm8937_firmwarewcn3660_firmwareipq8071amsm8976_firmwaresdm429w_firmwaremdm9630mdm9635mqca4010_firmwareipq5018_firmwarewcn3999_firmwareqca4004qcn5122_firmwaremdm9235mipq8076_firmwareipq8174_firmwaresd439_firmwaremdm9225m_firmwareipq8173sda429wmsm8953qcn5152_firmwarewcn3610sd632ipq5018sd429_firmwarewcn3610_firmwarewcn3998wcd9335wsa8810_firmwaremsm8952wcd9335_firmwarewcn3998_firmwareipq6010_firmwaremdm9225wsa8815qcs405qcn6023ipq6028msm8209apq8076_firmwaremsm8608wcd9306qcn9074wcn3660b_firmwareqcn9024qcn5164qca4010ipq8072aqca9889_firmwareqcn5154_firmwareipq6018_firmwareqca4020_firmwareipq5010_firmwareipq8173_firmwaremsm8108msm8956msm8940apq8037_firmwaremsm8956_firmwarepm8937_firmwareapq8009sd429csra6640_firmwareipq6000msm8917qca6174aipq8074asd450qca9888_firmwarecsr8811msm8976sgqet4101qsw8573qca4020apq8037sd205apq8016_firmwaremsm8909w_firmwareqca4024_firmwareapq8009_firmwareqca8081sd632_firmwaremsm8208msm8108_firmwarecsra6620apq8009wqca9377qcn5164_firmwarewcn3620qcn5052qcn6024_firmwarewcn3615_firmwaremsm8209_firmwareqca8075_firmwareqca9379_firmwaremdm9225mmdm9330qca8075qcn5152qcn6122_firmwareqcn5024_firmwaremsm8909wwcn3680apq8016apq8084_firmwareqca6174_firmwaremdm9635m_firmwareipq5010qca4024qcn6023_firmwareqcn9022_firmwareapq8052_firmwareapq8017_firmwareapq8053msm8937qca9889qcn9074_firmwareqsw8573_firmwaresda429w_firmwareqcn9070msm8952_firmwareqcn5022wsa8815_firmwarewcn3980_firmwareipq8078amdm9625qcn9000_firmwareqca6164ipq6028_firmwaremsm8608_firmwareipq8174mdm9625m_firmwareqca9377_firmwareqcn5124_firmwareqcn9070_firmwareqca8081_firmwareqcn9072_firmwaremdm9625_firmwaremsm8976ipq8078_firmwaremdm9330_firmwaremsm8953_firmwareqcs405_firmwarear8031_firmwaremdm9230qcn9100_firmwarewcn3680b_firmwaremsm8920mdm9235m_firmwarecsra6620_firmwarequalcomm215ipq6018ipq8070aqca9379qcn9024_firmwarewcd9326_firmwareapq8053_firmwarewcn3615qcn6132_firmwareqcn9100sd450_firmwareqcn6132qca6164_firmwareipq6000_firmwareqca9888Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25726
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.75%
||
7 Day CHG~0.00%
Published-04 Apr, 2023 | 04:46
Updated-03 Aug, 2024 | 04:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Buffer Over-read in MODEM

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-wcd9306wcd9380_firmwarewsa8830snapdragon_wear_1300ssg2125psxr2230p_firmwaremdm8207snapdragon_wear_1200wcd9330snapdragon_x5_lte_modem_firmwarewsa8832_firmwarewcn785x-5wcn685x-5qca4004_firmwarewcn785x-1_firmwareqts110wcd9306_firmwaresxr1230p_firmwarewsa8835wcd9380wsa8832snapdragon_wear_1100_firmwaresnapdragon_ar2_gen_1_platform_firmwaresnapdragon_wear_1200_firmwaressg2125p_firmwaressg2115psnapdragon_ar2_gen_1_platformmdm9206wcn685x-5_firmwarewcn685x-1_firmwaresxr1230pwcd9385wcn685x-1snapdragon_x5_lte_modemmdm8207_firmwaresnapdragon_wear_1100mdm9205_firmwarewcd9385_firmwaremdm9205mdm9206_firmwaremdm9207_firmwareqca4004sxr2230pwsa8830_firmwarewsa8835_firmwaressg2115p_firmwaresnapdragon_wear_1300_firmwarewcn785x-5_firmwarewcd9330_firmwarewcn785x-1mdm9207qts110_firmwareSnapdragon9205_lte_modem_firmwarewcd9380_firmwaresnapdragon_wear_1300_platform_firmware9207_lte_modem_firmwaresxr2230p_firmwaresnapdragon_x5_lte_modem_firmwaremdm8207_firmwarewsa8832_firmwarewcd9385_firmwarefastconnect_6900_firmwareqca4004_firmwaresnapdragon_1200_wearable_platform_firmwaresnapdragon_1100_wearable_platform_firmware9206_lte_modem_firmwarewsa8830_firmwarewcd9306_firmwaresxr1230p_firmwarewsa8835_firmwarefastconnect_7800_firmwaressg2115p_firmwaresnapdragon_ar2_gen_1_platform_firmwarewcd9330_firmwaressg2125p_firmwareqts110_firmware
CWE ID-CWE-126
Buffer Over-read
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-25706
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.38% / 30.06%
||
7 Day CHG+0.01%
Published-16 Sep, 2022 | 05:26
Updated-03 Aug, 2024 | 04:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-sm6250p_firmwareqcs610wcn3950_firmwareqcs2290qca6595au_firmwaresa6155qca6335msm8917qcs605_firmwaresd_675_firmwaresd632wcn3998wcd9371_firmwarewcn3950sm4125sd720gsd_8_gen1_5g_firmwarewcn3660bsd450_firmwaresd710_firmwaresd460_firmwaresm7315_firmwarewcn7850qca6574au_firmwarewcd9375_firmwaresa6155_firmwarewcn3998_firmwaremsm8909wapq8009w_firmwareqca6420apq8053_firmwaresm7450_firmwaresd680_firmwaresa8155_firmwaresd662_firmwareqca6430wcd9340qualcomm215_firmwaresd765gsw5100qca6436sd680wcn6851sa6155pqcs603_firmwarewcn7851_firmwarewcn3660_firmwarewcd9341qca6696_firmwarewcd9371sd750gsd870_firmwarewcn3910_firmwarewsa8830_firmwaresd855_firmwaresd660sd865_5g_firmwarewcn3988sd660_firmwarewcn7850_firmwaresa8195p_firmwaresm8475wcn6750_firmwaresd450wcn3991wcd9380_firmwaresdm429wmsm8996au_firmwaresw5100pqca6564ausdx55m_firmwarewcn6856_firmwaresd670_firmwareqca6574sd632_firmwarewcd9380qualcomm215sd690_5g_firmwaresdx50m_firmwareqca6430_firmwarewcd9335_firmwarewcn3980sd439_firmwareqca6335_firmwareqcs605wcd9340_firmwarewsa8815wcn6850wcn3910qca6320qca6426_firmwarewcn3660b_firmwarewcn3680sd695sd835wcn3980_firmwaresd730sdx55msm8475_firmwarewcn6740_firmwaremsm8953sd678_firmwarewcn3680_firmwarewcn6851_firmwareqcs603sd_636_firmwaresd670qca6564a_firmwareapq8009wqcm4290_firmwaresd480sd870wcn6855wsa8832sw5100p_firmwareqcs610_firmwaresa6145psd695_firmwaresdxr1apq8096ausdm630_firmwareqca6391_firmwaresd780g_firmwarewcd9370_firmwaresdx55sd888_firmwareapq8053sa8155psd675sd439wcn3660sm8475p_firmwareqcm2290wcn3991_firmwarewsa8830sd678qcs2290_firmwaresd_636qcs4290sd765g_firmwareqca6420_firmwareqca6390_firmwaresd690_5gsd730_firmwarewcd9370sd675_firmwareqca6426wcn3990_firmwaresdw2500_firmwarewcd9385_firmwaresdxr2_5g_firmwarewcd9326_firmwarewcn3615_firmwaresd662sa8155qca6320_firmwarewcn3680b_firmwaresdx55_firmwareqca6595auwcn3615sm7250p_firmwareqca6436_firmwareqca6564au_firmwaresd778gsa6155p_firmwareqca6310wcn7851qcs6490sd429sdxr2_5gsdm630wcn3988_firmwaresa6145p_firmwaresd429_firmwaresm6250sd778g_firmwaresa8195papq8017_firmwarewsa8810_firmwaresd765_firmwarewcd9326wcd9335qcs4290_firmwarewcd9385qcs6490_firmwareqca6390wcd9375sd750g_firmwareaqt1000sm6250_firmwaremsm8953_firmwaremsm8917_firmwarewcn3620_firmwareqcm6490sd888_5g_firmwarewsa8835_firmwarewcn3620wcn6850_firmwarewsa8815_firmwaresm7450apq8017qca6564aqcm2290_firmwarewcn3990sd_675sd780gsd865_5gsd888msm8909w_firmwarewsa8835msm8996ausdm429w_firmwaresd665_firmwaresd888_5gsm6250pqca6574awcn6855_firmwaresm7325pqca6310_firmwarewcn6750qca6574_firmwaresd855sm4125_firmwaresm7325p_firmwaresd665sd765qca6574a_firmwaresd768g_firmwaresm7315sd460qca6391sdxr1_firmwareaqt1000_firmwareqcm4290qcm6490_firmwaresdx50mwsa8832_firmwaresd480_firmwareqca6574ausa8155p_firmwaresd710wcd9341_firmwarewsa8810wcn6856wcn3680bsd835_firmwaresd768gwcn6740qca6696sd845_firmwaresdw2500apq8096au_firmwaresd845sm7250psd720g_firmwaresw5100_firmwaresm8475pSnapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CWE ID-CWE-125
Out-of-bounds Read
CVE-2022-22062
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.2||HIGH
EPSS-0.29% / 21.52%
||
7 Day CHG~0.00%
Published-02 Sep, 2022 | 11:31
Updated-03 Aug, 2024 | 03:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-qca9377_firmwaresd_8cx_gen3_firmwaremdm9640_firmwaresm6250p_firmwareqcs610qca8337qca6431_firmwarewcd9360_firmwaresdx65mdm9645wcn3950_firmwaresc8180x\+sdx55qcs2290qca6595au_firmwaresa6155qca6335msm8917csra6620_firmwareqcs605_firmwaresd_675_firmwarecsra6640_firmwareqcs6125_firmwaresd632msm8108sa415mwcn3998wcd9371_firmwaremsm8108_firmwarewcn3950sm4125sd720gsd_8cx_gen2_firmwaremdm9206_firmwaremdm9628sd_8_gen1_5g_firmwarewcn3660bsd450_firmwareqsm8350_firmwaresd710_firmwareqsm8350sd460_firmwareqca4020sm7315_firmwarewcn7850qca6574au_firmwarewcd9375_firmwareqca8081_firmwarewcn3998_firmwaresa6155_firmwaresdx12_firmwaremsm8909wapq8009w_firmwareqca6420apq8053_firmwarewcd9360sm7450_firmwaresd680_firmwareqca9367_firmwarewcn3999sd_8cx_gen2qrb5165_firmwareqrb5165m_firmwareqcs6125sa8155_firmwaresd662_firmwareqcs405qca6430wcd9340sd765gqualcomm215_firmwaresw5100sd680qca4020_firmwareqca6436wcn6851sa6155pqcs603_firmwarewcn7851_firmwaremsm8937msm8209_firmwaremdm9250_firmwarewcn3660_firmwarewcd9341pm8937_firmwareqca6696_firmwareqca6431wcd9371sd870_firmwaresd750gwcn3910_firmwaresd_8cxwsa8830_firmwaresd855_firmwaresd660sd865_5g_firmwaresd712wcn3988sd660_firmwarewcn7850_firmwaresa8195p_firmwaresm8475msm8208_firmwareqcn7606_firmwarewcn6750_firmwaresd450wcn3610msm8608mdm9640wcn3991qca8337_firmwarewcd9380_firmwaresdm429wsw5100pmsm8996au_firmwarewcd9330qca6564ausdx55m_firmwarewcn6856_firmwaremsm8940_firmwaresd670_firmwareqca6574sd632_firmwarewcd9380qualcomm215qcs410ipq4019_firmwaresd690_5g_firmwaresdx50m_firmwareqca9379_firmwaresdx24_firmwareqca6174qca6430_firmwarewcd9335_firmwaresd439_firmwarewcn3980qca6335_firmwareqcs605wcd9340_firmwarewsa8815wcn6850sd7cwcn3910qca6320qca6584_firmwaremsm8937_firmwaremdm9650_firmwareqca6426_firmwarewcn3660b_firmwarewcn3680sd695qca9984sd835wcn3980_firmwaresd730wcd9330_firmwaresdx55mqca6421_firmwaresm8475_firmwarewcn6740_firmwaremsm8953sd821_firmwaresd678_firmwarear8031_firmwarewcn3680_firmwareqrb5165wcn6851_firmwareqcs603sd670sd_636_firmwareqca6564a_firmwareapq8009wqcm4290_firmwaresd480sd870wcn6855qcn7605_firmwarewsa8832sw5100p_firmwaresd210_firmwareqcs610_firmwaresa6145psd695_firmwaresdxr1ar8031apq8096auqca6595_firmwareqcs405_firmwaresdm630_firmwaresd820_firmwareqca6391_firmwarewcd9370_firmwaresd780g_firmwaresdx55sd888_firmwareapq8053sa8155pcsra6640sd675sd439wcn3660sm8475p_firmwareqca9379ar8035_firmwareqcm2290qcn7606wcn3991_firmwaremdm9150_firmwarewsa8830sd678qcs2290_firmwaresd7c_firmwarecsrb31024mdm9628_firmwaremdm9650sd_636csra6620qcs4290mdm9250sd765g_firmwareqca6420_firmwareqca6390_firmwareapq8009_firmwaresd690_5gqca6174_firmwaresd730_firmwarewcd9370sd675_firmwareqca6564qca6426wcn3990_firmwareqrb5165n_firmwareqca9984_firmwareqca9377sdw2500_firmwaresd_8cx_firmwarewcd9385_firmwaresdxr2_5g_firmwareqcn7605wcd9326_firmwarewcn3615_firmwaresd662apq8037sa8155qca6320_firmwareqca6584wcn3680b_firmwaresdx55_firmwarewcn3615qca6595auwcn3999_firmwaresm7250p_firmwarewcn3610_firmwareqca6436_firmwareqrb5165nqca6564au_firmwaresd778gsa6155p_firmwareqca6310msm8208pm8937wcn7851sd429sa515m_firmwareqcs6490sdxr2_5gqca9367sdm630mdm9607_firmwaresd821sa415m_firmwarewcn3988_firmwaresd429_firmwaresa6145p_firmwareqca6421sd778g_firmwaresm6250sd712_firmwaresa8195papq8017_firmwarewsa8810_firmwaresd765_firmwarewcd9326wcd9335qca8081qca6174a_firmwareqcs4290_firmwarewcd9385qcs6490_firmwaresd_8cx_gen3qca6390wcd9375sd750g_firmwareaqt1000ar8035ipq4019sc8180x\+sdx55_firmwaresm6250_firmwaremsm8953_firmwaremsm8917_firmwaresd210wcn3620_firmwaresdx20_firmwarewsa8815_firmwaresd888_5g_firmwaresd820qcm6490wcn6850_firmwarewsa8835_firmwarewcn3620sm7450apq8017qca6564aqcm6125_firmwareqcm2290_firmwarewcn3990sd_675sd780gsd865_5gqca6595sdx24sd888msm8909w_firmwarewsa8835msm8996ausdm429w_firmwaresd665_firmwaresd888_5gsm6250pqca6574amdm9206wcn6855_firmwareqca6174asm7325pqca6310_firmwarewcn6750sa515mqca6574_firmwaresd855sm4125_firmwaresm7325p_firmwaresd665qca6175asd765qca6574a_firmwaresd768g_firmwaremsm8209qrb5165msd850_firmwaresm7315apq8009sd460qca6391sdxr1_firmwareaqt1000_firmwaremsm8920sdx65_firmwaremdm9626qcm4290csrb31024_firmwareqcm6490_firmwarewsa8832_firmwaresdx50msdx20sd480_firmwaremsm8920_firmwaremdm9626_firmwareqca6574ausd710sa8155p_firmwaremdm9607mdm9645_firmwarewcd9341_firmwareqcm6125wsa8810mdm9150wcn6856wcn3680bsd835_firmwareqca6564_firmwaresd768gwcn6740qca6696sd845_firmwaremsm8608_firmwaresdw2500msm8940apq8096au_firmwaresd845apq8037_firmwaresm7250psd720g_firmwaresdx12sw5100_firmwareqcs410_firmwareqca6175a_firmwaresd850sm8475pSnapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CWE ID-CWE-125
Out-of-bounds Read
CVE-2021-43845
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-8.2||HIGH
EPSS-3.72% / 88.59%
||
7 Day CHG~0.00%
Published-27 Dec, 2021 | 00:00
Updated-04 Nov, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Prevent out-of-bounds read in PJSIP

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.

Action-Not Available
Vendor-teluupjsipDebian GNU/Linux
Product-pjsipdebian_linuxpjproject
CWE ID-CWE-125
Out-of-bounds Read
  • Previous
  • 1
  • 2
  • Next
Details not found