CVE-2018-11263

CVE-2018-11263 concerns CAF-derived Android WLAN code in the Linux kernel used on Android for MSM, Firefox OS for MSM, and QRD Android. The issue arises when the radio_id received from the FW is greater than or equal to the maximum, allowing an out-of-bounds write while copying radio stats. The v...

CVE-2018-11276

CVE-2018-11276 is a kernel-level vulnerability in the CAF Qualcomm Linux kernel used by Android for MSM, Firefox OS for MSM, and QRD Android. The issue is a double free of memory during driver probe failure, where memory allocated is freed twice, risking kernel instability or a crash. Documented ...

CVE-2018-11297

CVE-2018-11297 affects Qualcomm WLAN Host in Android (CAF/Linux kernel-based builds such as Android for MSM) where the WMA NDP event handler can over-read due to missing validation of input value event_info received from firmware. This is described as a buffer over-read/overflow in the WLAN Host ...

CVE-2018-11302

CVE-2018-11302 corresponds to a WLAN buffer overflow issue described in Qualcomm CAF Android variants (Android for MSM, Firefox OS for MSM, QRD Android) where input from userspace could be copied into a kernel buffer without proper validation. The CVE is listed under the Qualcomm component mappin...

CVE-2018-11842

CVE-2018-11842 describes a memory-management fault in Qualcomm CAF WLAN host driver used in Android CAF builds during WLAN association. When memory allocation fails, the driver frees memory that was not allocated, indicating a potential use-after-free/memory-corruption condition. The vulnerabilit...

CVE-2018-12011

Technical details about CVE-2018-12011 are not provided in the supplied documents; no exposed affected products, versions, or remediation are specified here. Monitor for updates.

CVE-2018-3567

CVE-2018-3567 is a WLAN buffer overflow affecting Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds leveraging CAF on Linux kernels before 2018-04-05. The vulnerability arises in WLAN when processing HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages (root cause:...

CVE-2018-3570

CVE-2018-3570 refers to a vulnerability in the cpuidle driver used by CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that rely on the Linux kernel. The issue arises from incorrect use of the list_for_each macro, which could lead to an untrusted pointer dereference. Connecte...

CVE-2018-5825

CVE-2018-5825 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels prior to the 2018-04-05 patch level. The kernel IPA driver contains a Use-After-Free condition in the IPA subsystem, as described in the NVD record. The vulnerability is rated with CV...

CVE-2018-5827

CVE-2018-5827 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with Linux kernels older than the 2018-04-05 patch level. The issue is a WLAN buffer overflow occurring while processing an extscan hotlist event. Public references in the CVE indicate a high-seve...

CVE-2018-5832

CVE-2018-5832 infers a race condition in a camera driver ioctl handler on CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a Use-After-Free condition triggered by a race in the driver path prior to the security patch level 2018-06-05....

CVE-2018-5909

CVE-2018-5909 is documented as a buffer overflow affecting the Rotator component in Qualcomm, reported in Android CAF builds. The vulnerability arises from a lack of proper buffer-size checking in display handling code, which may permit memory corruption. The CVE is listed under Qualcomm componen...

CVE-2020-0065

CVE-2020-0065 corresponds to an improper authorization in the receiver component of the Android Suite Daemon (MediaTek section, Android 2020-05-01/05 patch levels). According to NVD, it supports LOCAL access with LOW attack complexity but can affect confidentiality (HIGH) with no integrity/availa...

CVE-2020-0232

CVE-2020-0232 is reported in the Android kernel (Airbrush component). The issue arises when abc_pcie_issue_dma_xfer_sync creates a transfer object, stores it in a session, and a concurrent thread can fetch that object and delete it via abc_pcie_dma_user_xfer_clean. If this occurs, the original th...

CVE-2021-0456

CVE-2021-0456 : In the Citadel chip firmware, there is a possible out-of-bounds write due to a missing bounds check, enabling local escalation of privilege with System execution privileges required. Affected: Citadel chipset firmware in Android kernels (Android ID A-174769927). Impact per sources...

CVE-2021-0463

CVE-2021-0463 concerns Google Android’s kernel component where in convertToHidl (convert.cpp) an out-of-bounds read can occur due to uninitialized data from ReturnFrameworkMessage. This issue may disclose local information without extra execution privileges and requires user interaction to exploi...

CVE-2021-0532

CVE-2021-0532 affects the Android memory management driver and is caused by a race condition that can lead to memory corruption and local escalation of privilege with no additional privileges or user interaction required. The description is consistent across multiple sources (NVD, Red Hat, CVE li...

CVE-2024-56192

CVE-2024-56192 affects Google Pixel Watch: a missing bounds check in wl_notify_gscan_event (wl_cfgscan.c) enables an out-of-bounds write that could allow local privilege escalation without user interaction. Exploitation status is not provided in the supplied documents; remediation is to apply pat...

CVE-2014-9926

Technical details about CVE-2014-9926 (GNSS Use-After-Free in CAF Linux kernel) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-9928

Technical details are not publicly available in the provided documents. Monitor for updates and new disclosures regarding CVE-2014-9928.

CVE-2014-9951

Technical details about CVE-2014-9951 are not provided in the supplied documents. Please monitor for updates.

CVE-2015-1527

CVE-2015-1527 is tied to an integer overflow in IAudioPolicyService.cpp in Android, enabling local privilege escalation via a crafted app (Android Bug ID 19261727). Public records consolidate this as a local‑privilege‑escalation flaw in the Android audio policy service. The connected sources refe...

CVE-2015-9006

Technical details for CVE-2015-9006 are not publicly available in the provided documents. Monitor for updates.

CVE-2015-9012

CVE-2015-9012 describes an elevation of privilege in Qualcomm closed‑source components within Android, affecting the Android kernel. The linked records consistently identify the issue as a privilege escalation vulnerability in Qualcomm components used by Android devices, with no public exploit de...

CVE-2016-10393

CVE-2016-10393 describes an integer-overflow in Android for MSM, Firefox OS for MSM, and QRD Android builds (CAF Linux kernel) when processing oversized clips. This causes the allocated buffer to be smaller than needed, enabling potential buffer overflow during subsequent operations. The vulnerab...

CVE-2016-11025

CVE-2016-11025 affects Samsung mobile devices with Exynos AP chipsets (software through 2016-09-13). The issue is a heap-based memcpy overflow in the OTP service, pegged as high-severity with CVSS v3.1: CRITICAL (9.8) and network attack vector. The problem is linked to the OTP service boundary ch...

CVE-2016-11028

CVE-2016-11028 : A stack-based buffer overflow exists in the OTP TrustZone trustlet on Samsung mobile devices with Exynos AP chipsets (firmware up to 2016-09-13). Affected Samsung IDs are SVE-2016-7173 and SVE-2016-7174. The issue, described across multiple sources, does not provide explicit expl...

CVE-2017-11024

CVE-2017-11024 describes a race condition in the rmnet USB control driver within Android/CAF Linux-kernel based builds on MSM platforms, which can lead to a Use-After-Free condition. Affected: Android MSM, Firefox OS for MSM, and QRD Android releases using CAF Linux kernel. Impact is described as...

CVE-2017-11069

CVE-2017-11069 is a heap overflow in the SafeSwitch image handling, reported for Android for MSM platforms (CAF/Linux kernel) and associated Qualcomm bootloader contexts. The vulnerability arises from manipulation of SafeSwitch Image data, and is categorized in the Qualcomm bootloader area as an ...

CVE-2017-11075

CVE-2017-11075 concerns a use-after-free in wdsp_glink_write() when cmd_pkt and reg_pkt are invoked from different userspace threads on Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds prior to the CAF kernel patch level 2018-04-05. Affected components include the Audio DSP dr...

CVE-2017-13172

CVE-2017-13172 is a local, Elevation of Privilege vulnerability in the MediaTek Bluetooth driver used by Android kernels. The issue affects the Bluetooth subsystem of MediaTek components and enables privilege escalation without requiring user interaction; CVSSv3 base score 7.8 (HIGH). The NVD ent...

CVE-2017-13244

CVE-2017-13244 is an Elevation of Privilege (EoP) flaw in the Android kernel Easel driver. The upstream kernel Easel component is affected, enabling privilege escalation on Android devices. The issue is classified as EoP with Moderate severity in the Pixel/Nexus bulletin, and addressed by patch l...

CVE-2017-14902

CVE-2017-14902 describes a race condition in the GLink kernel driver across Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability is a Use-After-Free in the GLink driver that can potentially allow a local attacker to compromise the device (as indic...

CVE-2017-15820

CVE-2017-15820 affects Qualcomm Graphics_Linux in Android CAF builds using the Linux kernel. The issue is a Use-After-Free in a KGSL IOCTL handler, enabling potentially elevated privileges if exploited locally. The Android Security Bulletin (CAF/Linux path) classifies the CVE under Graphics_Linux...

CVE-2017-15846

The CVE-2017-15846 entry affects the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-09-16. Root cause: an untrusted pointer dereference in video_ioctl2() could occur. Impact per sources is potentially high (partial to full confidentiality, integrity, and avail...

CVE-2017-17765

CVE-2017-17765 concerns Qualcomm WLAN in Android CAF builds using the Linux kernel. The issue arises when values received from firmware are not properly validated in the function wma_get_ll_stats_ext_buf() , causing an integer overflow in buffer size calculations that can lead to a buffer overflo...

CVE-2017-18052

CVE-2017-18052 affects Qualcomm WLAN in Android devices (CAF Linux kernel line) via the wma_mgmt_tx_bundle_completion_handler() function. The root cause is improper input validation for cmpl_params->num_reports, param_buf->desc_ids, and param_buf->status received from firmware, leading t...

CVE-2017-18056

CVE-2017-18056 affects Android for MSM, Firefox OS for MSM, and CAF Linux-kernel builds, where improper input validation for vdev_id in wma_unified_bcntx_status_event_handler() (received from firmware) can cause an out-of-bounds memory read. The issue is tied to the WLAN stack (Qualcomm component...

CVE-2017-18058

CVE-2017-18058 describes an out-of-bounds memory read in Qualcomm WLAN when processing wow_buf_pkt_len in wma_wow_wakeup_host_event(), triggered by firmware input. Affected platforms include Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux-based Android releases. Root cause is impr...

CVE-2017-18061

CVE-2017-18061 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The vulnerability stems from a potential buffer overflow when processing an AOA (Android Open Accessory) measurement event from WIGIG firmware in wil_aoa_evt_meas(), with Wil6210 as the rela...

CVE-2017-18070

CVE-2017-18070 describes a vulnerability in Qualcomm WLAN on Android (CAF) where, in the function wma_ndp_end_response_event_handler() , the local variable len_end_rsp (uint32) can overflow if event->num_ndp_end_rsp_per_ndi_list is very large. This overflow can lead to a heap overwrite of the ...

CVE-2017-18147

CVE-2017-18147 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds from CAF using the Linux kernel prior to the 2018-04-05 patch level. In MMCP, a downlink message is not properly validated, enabling potential network-based impact without authentication. CVSS metrics indi...

CVE-2017-6292

Summary: CVE-2017-6292 is an integer overflow in NVIDIA TLZ TrustZone’s TA-to-TA communication handler that can cause an out-of-bounds write, potentially enabling local code execution or denial of service within TrustZone. Affected: NVIDIA TLZ TrustZone OS components on Android devices (notably S...

CVE-2018-11265

CVE-2018-11265 concerns a buffer overflow in Qualcomm MProc when Android CAF/Linux kernel handles log_buf with a uint64_t; the log_buf pointer may access memory beyond bounds when incremented in memcpy. Multiple sources (NVD entry and CNVD/PRION-style mappings) associate this with Android on Pixe...

CVE-2018-11293

CVE-2018-11293 affects Qualcomm WLAN Host in Android variants built on CAF Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue arises in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler where ndp_cfg_len and num_ndp_app_info are taken from firmware without...

CVE-2018-11296

CVE-2018-11296 is a Qualcomm WLAN Host buffer overflow affecting Android on Pixel/Nexus devices, caused by a buffer overwrite while processing a firmware message in the WLAN handler. The vulnerability is in the Qualcomm WLAN Host within CAF/Linux-based builds. Impact is memory corruption potentia...

CVE-2018-3582

CVE-2018-3582 is a buffer overflow in Qualcomm WLAN affecting Android Pixel/Nexus devices, stemming from improper input validation in WMA event handling. The vulnerability is classified as Elevation of Privilege (EoP) with a Medium impact in the Android/Qualcomm WLAN component. Connected sources ...

CVE-2018-5820

CVE-2018-5820 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF builds using Linux kernel prior to the 2018-04-05 patch level. The issue arises in wma_tbttoffset_update_event_handler(), where a firmware-supplied parameter is used to allocate a local buffer without prope...

CVE-2018-5831

CVE-2018-5831 affects the KGSL driver in CAF Android builds that use the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The vulnerability stems from a reference counting error that can trigger a Use-After-Free condition. The impact is described in the Android/CAF context as a lo...

CVE-2019-9471

CVE-2019-9471 affects Android kernel code abc-pcie.c, specifically in set_outbound_iatu, where a missing bounds check can cause an out-of-bounds write. This leads to local elevation of privilege with system execution privileges required; exploitation does not require user interaction. Public refe...