Qualcomm known exploited vulnerabilities
CISA lists 12 Qualcomm CVEs as exploited in the wild. 1 were added in the last 12 months (latest 2026-03-03), and 0 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2020-11261 (Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables): EPSS 1.6%, added 2021-12-01
- CVE-2021-1905 (Multiple Chipsets): EPSS 1.5%, added 2021-11-03
- CVE-2026-21385 (Multiple Chipsets): EPSS 1.2%, added 2026-03-03
- CVE-2025-27038 (Multiple Chipsets): EPSS 1.0%, added 2025-06-03
- CVE-2023-33106 (Multiple Chipsets): EPSS 0.9%, added 2023-12-05
Most affected Qualcomm products
Multiple Chipsets (10), Multiple Chipsets (1), Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (1).
All Qualcomm CVEs in KEV
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2026-21385 | Multiple Chipsets | Multiple Chipsets Memory Corruption | 2026-03-03 | 2026-03-24 | 1.2% | – |
| CVE-2025-27038 | Multiple Chipsets | Multiple Chipsets Use-After-Free | 2025-06-03 | 2025-06-24 | 1.0% | – |
| CVE-2025-21480 | Multiple Chipsets | Multiple Chipsets Incorrect Authorization | 2025-06-03 | 2025-06-24 | 0.5% | – |
| CVE-2025-21479 | Multiple Chipsets | Multiple Chipsets Incorrect Authorization | 2025-06-03 | 2025-06-24 | 0.8% | – |
| CVE-2024-43047 | Multiple Chipsets | Multiple Chipsets Use-After-Free | 2024-10-08 | 2024-10-29 | 0.7% | – |
| CVE-2023-33107 | Multiple Chipsets | Multiple Chipsets Integer Overflow | 2023-12-05 | 2023-12-26 | 0.9% | – |
| CVE-2023-33106 | Multiple Chipsets | Multiple Chipsets Use of Out-of-Range Pointer Offset | 2023-12-05 | 2023-12-26 | 0.9% | – |
| CVE-2023-33063 | Multiple Chipsets | Multiple Chipsets Use-After-Free | 2023-12-05 | 2023-12-26 | 0.7% | – |
| CVE-2022-22071 | Multiple Chipsets | Multiple Chipsets Use-After-Free | 2023-12-05 | 2023-12-26 | 0.5% | – |
| CVE-2020-11261 | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Multiple Chipsets Improper Input Validation | 2021-12-01 | 2022-06-01 | 1.6% | – |
| CVE-2021-1906 | Multiple Chipsets | Multiple Chipsets Detection of Error Condition Without Action | 2021-11-03 | 2021-11-17 | 0.5% | – |
| CVE-2021-1905 | Multiple Chipsets | Multiple Chipsets Use-After-Free | 2021-11-03 | 2022-05-03 | 1.5% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · All vendors