CVE-2025-21473 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption when using Virtual cdm Camera Data Mover to write registers...

CVE-2025-21473

CVE-2025-21473 describes a memory corruption vulnerability in Qualcomm chipsets when using Virtual cdm (Camera Data Mover) to write registers. The root cause is memory corruption from register writes, with references across sources noting a TOCTOU race aspect in Camera_Linux. Impact is described ...

CVE-2025-21461 Out-of-bounds Write in Camera_Linux

Memory corruption when programming registers through virtual CDM...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets that stems from a memory corruption that could result from writing to registers using Virtual cdm...

PT-2025-32124 · Cdm · Cdm

Name of the Vulnerable Software and Affected Versions: Affected versions not specified Description: A memory corruption issue exists when programming registers through a virtual CDM. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CVE-2025-21461: Out-of-bounds Write

Memory corruption when programming registers through virtual CDM...

CVE-2025-21473: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory corruption when using Virtual cdm Camera Data Mover to write registers...

CVE-2024-36068

An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code...

CVE-2023-21120

In multiple functions of cdmengine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID:...

MAL-2025-1042 Malicious code in lib-automotive-call-cdm (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in lib-automotive-call-cdm (npm)

The package communicates with a domain associated with malicious activity...

CISA Releases New Public Version of CDM Data Model Document

Today, the Cybersecurity and Infrastructure Security Agency CISA released an updated public version of the Continuous Diagnostics and Mitigation CDM Data Model Document. Version 5.0.1 aligns with fiscal year 2023 Federal Information Security Modernization Act FISMA metrics. The CDM Data Model...

CVE-2024-36068

An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code...

CVE-2024-36068

An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code...

CVE-2024-36068

CVE-2024-36068 affects Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6, and 8.1.3-p12. The vulnerability is described as an incorrect access control that allows an attacker with network access to execute arbitrary code. The connected documents reiterate the affected versions and impact but do not...

CVE-2024-36068

An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code...

CVE-2024-31320

In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-31320

In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21120

In multiple functions of cdmengine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID:...

SUSE CVE-2016-2837

Heap-based buffer overflow in the ClearKey Content Decryption Module CDM in the Encrypted Media Extensions EME API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media...