Qualcomm — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Qualcomm with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 12 Qualcomm vulnerabilities confirmed as exploited in the wild across 3 products; none are currently flagged as used in known ransomware campaigns. Multiple Chipsets is the most-affected product, with 10 entries (83% of the total). CISA added 1 entry in 2026 so far, compared with 3 in 2025. Across the 12 entries with an NVD CVSS score (100% of the total), the average score is 8.0; none is rated critical by NVD. The most recent addition is CVE-2026-21385 (Qualcomm Multiple Chipsets Memory Corruption Vulnerability), added on 2026-03-03.
Affected products
| Product | Entries | Share |
|---|---|---|
| Multiple Chipsets | 10 | 83% |
| Multiple Chipsets | 1 | 8.3% |
| Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 1 | 8.3% |
Entries added per year
By date added to the KEV catalog
Exploited Qualcomm vulnerabilities (12)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-21385 | Multiple Chipsets | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 2026-03-03 | — | HIGH7.8 |
| CVE-2025-21479 | Multiple Chipsets | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-03 | — | HIGH8.6 |
| CVE-2025-21480 | Multiple Chipsets | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-03 | — | HIGH8.6 |
| CVE-2025-27038 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2025-06-03 | — | HIGH7.5 |
| CVE-2024-43047 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2024-10-08 | — | HIGH7.8 |
| CVE-2023-33107 | Multiple Chipsets | Qualcomm Multiple Chipsets Integer Overflow Vulnerability | 2023-12-05 | — | HIGH8.4 |
| CVE-2023-33106 | Multiple Chipsets | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability | 2023-12-05 | — | HIGH8.4 |
| CVE-2023-33063 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2023-12-05 | — | HIGH7.8 |
| CVE-2022-22071 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2023-12-05 | — | HIGH8.4 |
| CVE-2020-11261 | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 2021-12-01 | — | HIGH7.8 |
| CVE-2021-1906 | Multiple Chipsets | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability | 2021-11-03 | — | MEDIUM6.2 |
| CVE-2021-1905 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.4 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.