CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Qualcomm Multiple Chipsets Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Description
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Affected products
qualcomm: apq8053 firmware; qualcomm: apq8053; qualcomm: ar8031 firmware; qualcomm: ar8031; qualcomm: ar8035 firmware; qualcomm: ar8035; qualcomm: csra6620 firmware; qualcomm: csra6620; qualcomm: csra6640 firmware; qualcomm: csra6640; qualcomm: mdm9150 firmware; qualcomm: mdm9150; qualcomm: msm8953 firmware; qualcomm: msm8953; qualcomm: qca6174a firmware
References3
- www.qualcomm.com/company/product-security/bulletins/may-2022-bu… PatchVendor Advisory
- www.qualcomm.com/company/product-security/bulletins/may-2022-bu… PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 35 · as of 2 November 2026
- CWE
- CWE-416