Qualcomm vulnerabilities
- Qualcomm has 743 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #21 of 420 vendors on this site by that count.
- Of the 743 with a CVSS score, 563 (75.8%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 12 vulnerabilities attributed to Qualcomm are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-21385, was added on 3 Mar 2026.
- None of them is marked as known to be used in ransomware campaigns.
- For the 12 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 1 day.
Records are attributed to Qualcomm from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 341 |
| 2018 | 671 |
| 2019 | 295 |
| 2020 | 304 |
| 2021 | 261 |
| 2022 | 246 |
| 2023 | 314 |
| 2024 | 257 |
| 2025 | 273 |
| 2026 | 152 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 152 | 3 | 102 | 69.1% | 0% |
| 2025 | 273 | 5 | 208 | 78% | 0% |
| 2024 | 257 | 14 | 185 | 77.4% | 0% |
| 2023 | 314 | 32 | 206 | 75.8% | 0% |
| 2022 | 246 | 25 | 178 | 82.5% | 0% |
| 2021 | 261 | 17 | 104 | 78.6% | 41% |
| 2020 | 304 | 0 | 0 | — | 100% |
| 2019 | 295 | 0 | 0 | — | 100% |
| 2018 | 671 | 0 | 0 | — | 100% |
| 2017 | 341 | 0 | 0 | — | 100% |
| Before 2017 | 1 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-21385 | Multiple Chipsets | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 2026-03-03 | Unknown |
| CVE-2025-21479 | Multiple Chipsets | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-03 | Unknown |
| CVE-2025-21480 | Multiple Chipsets | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-03 | Unknown |
| CVE-2025-27038 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2025-06-03 | Unknown |
| CVE-2024-43047 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2024-10-08 | Unknown |
| CVE-2022-22071 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2023-12-05 | Unknown |
| CVE-2023-33063 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2023-12-05 | Unknown |
| CVE-2023-33106 | Multiple Chipsets | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability | 2023-12-05 | Unknown |
| CVE-2023-33107 | Multiple Chipsets | Qualcomm Multiple Chipsets Integer Overflow Vulnerability | 2023-12-05 | Unknown |
| CVE-2020-11261 | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 2021-12-01 | Unknown |
| CVE-2021-1905 | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1906 | Multiple Chipsets | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Qualcomm records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2020-3657 | 26.6% | 98% | Not scored | No |
| CVE-2020-11117 | 19.7% | 97.4% | Not scored | No |
| CVE-2020-11264 | 13.2% | 96.4% | Critical | No |
| CVE-1999-0006 | 12.1% | 96.1% | Critical | No |
| CVE-2020-11301 | 11.1% | 95.9% | Critical | No |
| CVE-2015-9222 | 4.3% | 91% | Not scored | No |
| CVE-2021-30351 | 4% | 90.5% | Critical | No |
| CVE-2017-8248 | 3.1% | 87.6% | Not scored | No |
| CVE-2021-1965 | 3% | 87.4% | Critical | No |
| CVE-2017-18067 | 2.9% | 86.9% | Not scored | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.