CVE-2017-11081

CVE-2017-11081 affects Android for MSM, Firefox OS for MSM and QRD Android on CAF Linux kernel branches. The vulnerability resides in the hdd_parse_setrmcenable_command and hdd_parse_setrmcactionperiod_command APIs, where buffers defined in this API can hold at most 32 bytes, but data longer than...

CVE-2017-13271

CVE-2017-13271 is an Elevation of Privilege affecting the upstream kernel mnh_sm driver used by Android kernels. The issue is categorized as EoP with moderate impact in the Kernel components section of the CVE list, indicating a privilege escalation via the mnh_sm driver. The Android Pixel/Nexus ...

CVE-2017-14870

CVE-2017-14870 affects Android for MSM/CAF Linux-based Android (Android builds using CAF), specifically involving 1088 bytes of stack memory leakage during eMMC recovery message updates. The vulnerability is categorized as information disclosure with partial confidentiality impact and could be ex...

CVE-2017-14883

CVE-2017-14883 affects Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-18. The issue arises in wma_unified_power_debug_stats_event_handler() when FW command buffer’s param_buf->num_debug_register is near the 32‑bit uint max; the calculation for stats_registers_len may ove...

CVE-2017-14900

CVE-2017-14900 describes a buffer overrun in the WLAN vendor path when the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI is processed and the MAC address attribute contains fewer than 6 bytes. Affected stack includes Android for MSM, Firefox OS for MSM, QRD Android, and CAF Android releases using the ...

CVE-2017-15847

CVE-2017-15847. A race condition in the SPCom kernel driver on Android for MSM (CAF Linux kernel lineage) during channel creation. Affected: Android variants using CAF/Linux kernel with SPCom. Impact per NVD: partial confidentiality/integrity/availability impact; CVSSv3 base score 7.0 (HIGH), LOC...

CVE-2017-15853

The CVE-2017-15853 issue affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds on CAF kernels prior to the 2018-04-05 patch level. Root cause: during PTT processing, ptt_sock_send_msg_to_app() may be called without validating packet length, enabling a buffer over-read. Impa...

CVE-2017-8258

CVE-2017-8258 corresponds to an array out-of-bounds access in the camera driver of Qualcomm components on CAF Android releases using the Linux kernel. The vulnerability affects Qualcomm camera driver access within the kernel space and could potentially be triggered by interactions with the camera...

CVE-2017-9710

CVE-2017-9710 is described as a buffer overflow in the IOCTL path used to send QMI NOTIFY REQ messages in Android for MSM, Firefox OS for MSM, and CAF Android builds using the Linux kernel. The root cause is that the IOCTL interface can be invoked from multiple contexts, enabling a buffer overflo...

CVE-2017-9716

CVE-2017-9716 affects the Qualcomm Qbt1000 driver (Qualcomm components) in Android for MSM and related CAF-based kernels. The vulnerability is described as an Elevation of Privilege (EoP) issue, with CVE records (NVD, CVELIST, CNVD) confirming the driver as the vulnerable component and noting an ...

CVE-2018-11298

CVE-2018-11298 concerns a buffer overflow in Qualcomm WLAN Host within Android CAF builds using the Linux kernel. During processing of the SET_PASSPOINT_LIST command, the realm string passed from upper layers is not guaranteed to be NULL terminated, allowing strlen to determine its length and con...

CVE-2018-11300

CVE-2018-11300 affects Qualcomm WLAN Host in CAF Android releases (Android for MSM, Firefox OS for MSM, QRD Android) where a callback from a worker thread frees memory still in use by the WLAN subsystem, creating a classic Use‑After‑Free condition. This can impact kernel-level security in devices...

CVE-2018-11883

CVE-2018-11883 affects CAF-based Android WLAN implementations (Android for MSM, Firefox OS for MSM, QRD Android) running in the Linux kernel. The issue arises in the policy manager unit test: if the mode parameter in the WLAN function is out of bounds, it can trigger an out-of-bounds access when ...

CVE-2018-11894

CVE-2018-11894 is listed in Qualcomm WLAN HOST components with High severity. The provided documents indicate the issue arises from an integer overflow while processing preferred network offload scan results, which may lead to a buffer overflow when a large frame length is received from the firmw...

CVE-2018-11895

CVE-2018-11895 involves Qualcomm WLAN HOST components in Android CAF/linux-based WLAN stack. The available documents indicate a root cause of an improper length check in a WLAN function, which can cause the driver to write the default RSN capabilities into memory not allocated for the frame. The ...

CVE-2018-11897

The CVE-2018-11897 entry concerns CAF Android/Linux kernel WLAN code. Affected: Android releases (Android for MSM, Firefox OS for MSM, QRD Android) using CAF’s Linux kernel. The issue occurs while processing a diag event after connecting to a network, where an out-of-bounds read can occur if the ...

CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

CVE-2018-11912

The CVE-2018-11912 entry concerns CAF-based Android/Linux that may allow unprivileged access due to improper daemon configuration. Affected: Android releases for MSM, Firefox OS for MSM, and QRD Android built on CAF Linux kernel. Root cause stated as misconfigured daemons; impact described as unp...

CVE-2018-11962

CVE-2018-11962 affects Qualcomm audio components. The issue is a Use-After-Free in the heap during loading of audio effects config in the audio effects factory. It is a local (LOCAL) vulnerability with low attack complexity and requires no user interaction, per CVSS data (AV:L, AC:L, PR:L, UI:N, ...

CVE-2018-11986

CVE-2018-11986 : The vulnerability affects Android releases under CAF using the Linux kernel, specifically in the camera subsystem’s microcontroller FIFO (TX/RX) handling that exchanges commands between Micro FW and the CPP driver. The issue is a possible buffer overflow in these FIFOs. The NVD e...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2018-3577

CVE-2018-3577 affects Qualcomm WLAN within Android CAF builds (Android for MSM, etc.) prior to the 2018-06-05 patch level. The issue arises while processing fragments: when fragment count is very large, an integer overflow can cause a buffer overflow. The vulnerability is documented in multiple s...

CVE-2018-3596

CVE-2018-3596 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds that use CAF Android with the Linux kernel versions prior to the 2018-04-05 patch level. The vulnerability stems from legacy code that remained vulnerable after migration, with the note that this legacy cod...

CVE-2018-3597

CVE-2018-3597 affects the ADSP RPC driver in Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). Before the 2018-06-05 security patch level, this issue could allow an arbitrary kernel write via a local attack on vulnerable devices. The CVSS metrics in the...

CVE-2018-5828

Vulnerability CVE-2018-5828 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels prior to 2018-04-05. The issue is in function wma_extscan_start_stop_event_handler() where vdev_id is taken from firmware and not properly validated, potentially leading...

CVE-2018-5853

CVE-2018-5853 describes a race condition in a driver used by CAF Android for MSM (Linux kernel variants) including Android for MSM, Firefox OS for MSM, and QRD Android. The issue potentially leads to a use-after-free condition. Impact details in the provided sources indicate local attack requirem...

CVE-2018-5862

CVE-2018-5862 concerns Android CAF builds using the Linux kernel. In __wlan_hdd_cfg80211_vendor_scan(), when parsing SCAN_SSIDS and QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES, a buffer overwrite can potentially occur in all Android releases before patch level 2018-07-05. CVSS data in the entry shows l...

CVE-2018-5895

CVE-2018-5895 affects Qualcomm qcacld, specifically the wma_process_utf_event() path in Android on Google Pixel/Nexus devices prior to the 2018-06-05 patch level. The issue is a buffer over-read caused by improper buffer length validation when writing into param_buf->num_wow_packet_buffer, lea...

CVE-2018-5898

CVE-2018-5898 describes an integer overflow in the function msm_pcm_adsp_stream_cmd_put() within CAF Android for MSM Linux kernel code before the 2018-06-05 patch level. If user-supplied param_length exceeds a limit, the issue can affect local confidentiality, integrity, and availability (high im...

CVE-2018-5899

CVE-2018-5899 affects Android CAF builds (Android for MSM, Firefox OS for MSM, QRD Android) with the Linux kernel used in these releases. A use-after-free occurs in the TDLS path: netbuf is freed in ol_tx_completion_handler and subsequently accessed by NBUF_UPDATE_TX_PKT_COUNT. This use-after-fre...

CVE-2018-5919

CVE-2018-5919 affects the Qualcomm QCACLD-2.0 WLAN host driver in Android CAF/Linux kernels (Android for MSM, QRD Android). The issue is a use-after-free in the WLAN host driver that can cause the device to reboot. Public remediation references include a CodeAurora patch (commit 81a80c9973833f7cd...

CVE-2018-9514

CVE-2018-9514 is a kernel vulnerability affecting Android devices, caused by a Use After Free in sdcardfs_open (file.c) that could enable local escalation of privilege without user interaction. The issue is within the Android kernel and is listed in the 2018-10 Android security bulletin; patch gu...

CVE-2021-0488

CVE-2021-0488 affects Android with an out-of-bounds write in the nanopb-related code path (pb_write in pb_encode.c) due to a missing bounds check. The impact is local elevation of privilege, requiring local access and yielding System privileges; user interaction is not needed. Several connected s...

CVE-2025-36902

In CVE-2025-36902, the vulnerable component is syna_tcm2_sysfs.c, specifically the syna_cdev_ioctl_store_pid() function. It reports a heap buffer overflow causing an out-of-bounds write, which could enable local escalation of privilege with System execution privileges required. Exploitation requi...

CVE-2025-36934

CVE-2025-36934 is discussed in connected Google Project Zero posts as a 0-click/exploit chain involving the Dolby Unified Decoder (UDC) on Pixel devices. The vulnerability arises inside EMDF parsing in the UDC, where an attacker-controlled EMDF container can trigger a buffer overrun on the evo he...

CVE-2026-0038

CVE-2026-0038 describes a logic error in mem_protect.c across multiple functions that could allow arbitrary code execution, leading to local privilege escalation with no additional privileges and without user interaction. The available sources consistently reference mem_protect.c but do not provi...

CVE-2014-9949

CVE-2014-9949 is described as a TrustZone vulnerability in Android CAF builds that use the Linux kernel. The issue is an Untrusted Pointer Dereference in TrustZone, with impact articulated as high in the CVSS metrics (LOCAL exploit, low attack complexity, user interaction required, and high confi...

CVE-2016-0833

Technical details about CVE-2016-0833 are not publicly available in the supplied documents. Monitor for updates from official advisories.

CVE-2016-10233

CVE-2016-10233 is an elevation of privilege in the Qualcomm video driver affecting the Android kernel. The NVD entry documents a CRITICAL impact with a reported base score of 9.8 (CVSS3) and notes the vulnerability relates to the Qualcomm video driver; references include QC-CR#897452. Connected d...

CVE-2016-8486

The CVE-2016-8486 entry describes an information-disclosure vulnerability in Qualcomm closed-source components within Android kernel. Affected product/area: Android kernel with Qualcomm components. Root cause: information disclosure; impact: leakage of data to an attacker with local/proximate acc...

CVE-2017-0751

CVE-2017-0751 is a local elevation-of-privilege vulnerability in the Qualcomm QCE driver affecting Android kernel. Affected component: QCE driver within the Android platform; vulnerable code path enables a privileged escalation. Exploitation status is not detailed in the provided documents. The v...

CVE-2017-13170

CVE-2017-13170 is an elevation of privilege in the MediaTek display driver used by Android. The issue affects the Android kernel via the MediaTek display driver component and is described as a local EoP vulnerability with potential to gain privileged execution. The Android 2017-12-01/2017-12-05 s...

CVE-2017-14875

CVE-2017-14875 describes a heap overread in the ioctl handler VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE used by Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-05-23. The provided documents name the affected environments and the general vulnerability class but do not provide further root...

CVE-2017-14877

CVE-2017-14877 affects the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-08-31. Root cause: there is no mutex lock around allocated memory when processing IOCTLs, enabling a use-after-free if IPA_IOC_QUERY_RT_TBL_INDEX and IPA_IOC_DEL_RT_RULE are issued concurre...

CVE-2017-14901

CVE-2017-14901 describes a buffer overrun in the Qualcomm WLAN driver within Android for MSM/CAF Linux kernel when handling QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE with a TXPOWER_SCALE attribute of fewer than 1 byte. Affected components include Android devices using CAF/Linux kernel implement...

CVE-2017-18064

CVE-2017-18064 affects Android for MSM, Firefox OS for MSM, and CAF Android builds that use the Linux kernel. The issue is caused by improper input validation for p2p_noa_info in wma_send_bcn_buf_ll() which is obtained from firmware, leading to a potential buffer overflow. The vulnerability is as...

CVE-2018-11889

CVE-2018-11889 affects Android builds using CAF WLAN (Android for MSM, etc.) that rely on the Linux kernel. The vulnerability arises when requesting RSSI timeout, where the local variable context in a WLAN function is freed, potentially leading to access to invalid memory. This could enable memor...

CVE-2018-11891

CVE-2018-11891 is a high-severity issue affecting Qualcomm WLAN HOST code linked to CAF Android/Linux WLAN components. The vulnerability stems from a missing bounds check on array length in the WLAN HOST path, potentially enabling an out-of-bounds read in affected devices. Connected sources corro...

CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-11905

CVE-2018-11905 is a high-severity issue affecting Android CAF builds using the Linux kernel, involving a possible buffer overflow in a WLAN function caused by insufficient input validation of firmware-supplied values. The CVE is documented with a 3.0/3.0 score of 9.8 (CRITICAL) and a network atta...