Qualcomm · Multiple Chipsets

CVE-2021-1905

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Exploited in attacks High 8.4 Attack chance: 1.5%

What it is

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CISA: Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: May 7, 2021
Severity: High 8.4 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 1.5% in the top 25.2% of all known vulnerabilities
Weakness: CWE-416
More details: NVD · CVE.org · CISA

All references (1)

https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin

More exploited flaws from Qualcomm

Added	Vulnerability	Product	Severity	Attack chance
Mar 3, 2026	Memory CorruptionCVE-2026-21385	Multiple Chipsets	High 7.8	1.3%
Jun 3, 2025	Incorrect AuthorizationCVE-2025-21479	Multiple Chipsets	High 8.6	0.8%
Jun 3, 2025	Incorrect AuthorizationCVE-2025-21480	Multiple Chipsets	High 8.6	0.5%
Jun 3, 2025	Use-After-FreeCVE-2025-27038	Multiple Chipsets	High 7.5	1.1%
Oct 8, 2024	Multiple Chipsets Use-After-FreeCVE-2024-43047	Multiple Chipsets	High 7.8	0.7%
Dec 5, 2023	Use-After-FreeCVE-2022-22071	Multiple Chipsets	High 8.4	0.4%
Dec 5, 2023	Use-After-FreeCVE-2023-33063	Multiple Chipsets	High 7.8	0.7%
Dec 5, 2023	Use of Out-of-Range Pointer OffsetCVE-2023-33106	Multiple Chipsets	High 8.4	0.8%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.