CVE-2018-3578

CVE-2018-3578 is a heap overflow in the Qualcomm WLAN component caused by a type mismatch for ie_len, leading Android CAF/Linux kernel builds to allocate insufficient heap memory. The issue is described as a local vulnerability with HIGH impact (CVSS3: LOCAL, LOW complexity, NO privileges, USER i...

CVE-2018-3597

CVE-2018-3597 affects the ADSP RPC driver in Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). Before the 2018-06-05 security patch level, this issue could allow an arbitrary kernel write via a local attack on vulnerable devices. The CVSS metrics in the...

CVE-2018-3599

CVE-2018-3599 is a Use-After-Free in Qualcomm Core Services affecting Qualcomm Android for MSM/CAF-based Android builds (Linux kernel pre-2018-04-05 patch). The issue occurs when notifying a DCI client, enabling EoP with high/critical impact per the Android Pixel bulletin. Mitigation is to apply ...

CVE-2018-5850

CVE-2018-5850 affects Android CAF/Linux kernel components. The vulnerability arises from insufficient validation of a key length in csr_update_fils_params_rso(), which can cause an integer underflow and lead to a buffer overflow in affected Android releases using the Linux kernel. Provided docume...

CVE-2018-5855

CVE-2018-5855 affects Qualcomm WLAN Host components within Android CAF builds. The issue arises from padding/shrinking a nested WMI packet, potentially causing a buffer over-read in all CAF Android releases prior to the patched level. According to the CVE entry, this is rated critical (CVSS v3: 9...

CVE-2018-5893

CVE-2018-5893 is a buffer overwrite in the Qualcomm WLAN driver (htt_t2h_msg_handler_fast()) within Android CAF/Linux kernel for MSM devices. Root cause: buffer overwrite during firmware message processing. Affected: Qualcomm WLAN component in Android on CAF Android for MSM, Firefox OS for MSM, Q...

CVE-2018-5896

CVE-2018-5896 affects Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) prior to the 2018-06-05 security patch level. The issue is a kernel panic caused by an out-of-bounds read from not checking the source buffer length against the packet stream length ...

CVE-2021-0488

CVE-2021-0488 affects Android with an out-of-bounds write in the nanopb-related code path (pb_write in pb_encode.c) due to a missing bounds check. The impact is local elevation of privilege, requiring local access and yielding System privileges; user interaction is not needed. Several connected s...

CVE-2026-0108

The CVE-2026-0108 entry concerns misconfigured register protection on the PowerVR GPU, enabling local information disclosure without privileges or user interaction. The connected documents (Red Hat, ENISA EUVD, NVD, OSV, Android Pixel bulletin) describe the issue consistently but do not provide a...

CVE-2026-0148

The connected sources confirm a concrete issue in VideoRtpPayloadDecoderNode.cpp: an integer overflow can cause an out-of-bounds write, enabling remote code execution without extra privileges or user interaction. Affected component is VideoRtpPayloadDecoderNode.cpp (multiple functions). The CVE e...

CVE-2026-0161

CVE-2026-0161 affects Google Android (Pixel bulletin context) with an out-of-bounds write in RtpSession.cpp due to an integer overflow in numberOfReportBlocks, enabling remote privilege escalation without user interaction. Connected sources (Android Pixel bulletin) flag this as an Elevation of Pr...

CVE-2014-9959

CVE-2014-9959 is described as an elevation of privilege vulnerability affecting Qualcomm closed‑source components within Android, specifically the Android kernel. The initial description notes an elevation of privilege with high/critical impact, but the connected documents only reiterate the exis...

CVE-2016-10232

CVE-2016-10232 is an elevation-of-privil... (shortened to fit)

CVE-2016-10233

CVE-2016-10233 is an elevation of privilege in the Qualcomm video driver affecting the Android kernel. The NVD entry documents a CRITICAL impact with a reported base score of 9.8 (CVSS3) and notes the vulnerability relates to the Qualcomm video driver; references include QC-CR#897452. Connected d...

CVE-2016-10234

CVE-2016-10234 describes an information-disclosure vulnerability in the Qualcomm IPA driver within the Android kernel. The issue could allow a local attacker to access data outside of normal permissions. The CVE is listed under the Android security bulletin with affected devices (Nexus 5X, Nexus ...

CVE-2016-8486

The CVE-2016-8486 entry describes an information-disclosure vulnerability in Qualcomm closed-source components within Android kernel. Affected product/area: Android kernel with Qualcomm components. Root cause: information disclosure; impact: leakage of data to an attacker with local/proximate acc...

CVE-2017-11045

CVE-2017-11045 affects the Android camera stack (Android for MSM / CAF Linux kernel) in the camera driver function, where a race condition can lead to a Use-After-Free. The vulnerability is localized and impacts components related to Qualcomm/Camera in affected Android builds; CVSS scores indicat...

CVE-2017-13219

CVE-2017-13219 affects the Android kernel Synaptics touchscreen controller. Connected sources identify a denial-of-service flaw in the Upstream kernel’s Synaptics touchscreen component, exploitable on Android devices (e.g., Pixel/Nexus context). The vulnerability is a DoS with potential impact on...

CVE-2017-13271

CVE-2017-13271 is an Elevation of Privilege affecting the upstream kernel mnh_sm driver used by Android kernels. The issue is categorized as EoP with moderate impact in the Kernel components section of the CVE list, indicating a privilege escalation via the mnh_sm driver. The Android Pixel/Nexus ...

CVE-2017-14870

CVE-2017-14870 affects Android for MSM/CAF Linux-based Android (Android builds using CAF), specifically involving 1088 bytes of stack memory leakage during eMMC recovery message updates. The vulnerability is categorized as information disclosure with partial confidentiality impact and could be ex...

CVE-2017-14875

CVE-2017-14875 describes a heap overread in the ioctl handler VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE used by Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-05-23. The provided documents name the affected environments and the general vulnerability class but do not provide further root...

CVE-2017-14894

CVE-2017-14894 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with the Linux kernel prior to the 2018-04-05 patch level. In wma_vdev_start_resp_handler(), the vdev_id received from firmware can exceed the maximum BSSID stored in wma_handle->interfaces, l...

CVE-2017-14901

CVE-2017-14901 describes a buffer overrun in the Qualcomm WLAN driver within Android for MSM/CAF Linux kernel when handling QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE with a TXPOWER_SCALE attribute of fewer than 1 byte. Affected components include Android devices using CAF/Linux kernel implement...

CVE-2017-14914

CVE-2017-14914 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The issue arises when handles in the global client structure can become stale, per the NVD description. CVSS: 3.0/3.0 vector indicates Network attack, no user interaction, with High/CRITICAL...

CVE-2017-15853

The CVE-2017-15853 issue affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds on CAF kernels prior to the 2018-04-05 patch level. Root cause: during PTT processing, ptt_sock_send_msg_to_app() may be called without validating packet length, enabling a buffer over-read. Impa...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...

CVE-2017-18051

CVE-2017-18051 affects Android for MSM, Firefox OS for MSM, and QRD Android builds based on CAF Linux kernel. The root cause is improper input validation of event->vdev_id in wma_rcpi_event_handler() (received from firmware), which can lead to an out-of-bounds memory read. This vulnerability i...

CVE-2017-18064

CVE-2017-18064 affects Android for MSM, Firefox OS for MSM, and CAF Android builds that use the Linux kernel. The issue is caused by improper input validation for p2p_noa_info in wma_send_bcn_buf_ll() which is obtained from firmware, leading to a potential buffer overflow. The vulnerability is as...

CVE-2017-6423

CVE-2017-6423 is an elevation-of-privilege flaw in the Qualcomm Kyro L2 driver within the Android kernel. The vulnerability could allow a local attacker to execute arbitrary code with kernel privileges on affected devices (Pixel and Pixel XL are listed in the Android bulletin). The root cause is ...

CVE-2018-11274

CVE-2018-11274 is documented in the Pixel Security Bulletin under Qualcomm components (Audio). The entry classifies it as a moderate-impact audio buffer overflow affecting Qualcomm Audio; no exploitation details are provided in the supplied documents. The bulletin notes security patch levels of 2...

CVE-2018-11889

CVE-2018-11889 affects Android builds using CAF WLAN (Android for MSM, etc.) that rely on the Linux kernel. The vulnerability arises when requesting RSSI timeout, where the local variable context in a WLAN function is freed, potentially leading to access to invalid memory. This could enable memor...

CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

CVE-2018-11984

CVE-2018-11984 affects Android releases based on CAF/Linux DIAG driver. A use-after-free and an out-of-bounds access in the DIAG driver can lead to a local, high-impact condition. The accompanying CVSS3 base score is 7.8 (HIGH); CVSS2 is 4.6 (MEDIUM). The provided documents do not include exploit...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2018-3576

CVE-2018-3576 describes an improper validation of an array index in the Qualcomm WLAN driver’s sapInterferenceRssiCount() function, causing array out-of-bounds access on Android devices using the Linux kernel (CAF Android for MSM, Firefox OS for MSM, QRD Android). The issue affects Android releas...

CVE-2018-3587

CVE-2018-3587 is tied to the Qualcomm qcacld-2.0 WLAN driver in Android CAF builds, where a Use-After-Free in a firmware memory dump feature can lead to Elevation of Privilege (EoP). The NVD listing shows a CVSS v3 base score of 7.8 (HIGH) with LOCAL attack vector, low complexity, and privileges ...

CVE-2018-5828

Vulnerability CVE-2018-5828 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels prior to 2018-04-05. The issue is in function wma_extscan_start_stop_event_handler() where vdev_id is taken from firmware and not properly validated, potentially leading...

CVE-2018-5836

CVE-2018-5836 is elaborated in CNVD-2018-13387 as a Qualcomm WLAN information-disclosure issue affecting Android devices (Pixel/Nexus) prior to 2018-06-05. The root cause is that the wma_nan_rsp_event_handler() path fails to properly validate the data_len value received from firmware, enabling po...

CVE-2018-5857

In CVE-2018-5857, the issue is a Use-After-Free in the WCD CPE codec used by CAF Android releases (Android for MSM, Firefox OS for MSM, QRD Android) via the Linux kernel. The root cause is a memory management defect in wcd_cpe_core that can be triggered locally. The CVSS metrics indicate a Local ...

CVE-2021-0465

CVE-2021-0465 affects the Android kernel component used by Pixel devices, specifically the GenerateFaceMask function in face.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with no extra execution privileges required and no user ...

CVE-2026-0150

CVE-2026-0150 affects EdgeTPU firmware, specifically the ExecuteGraph command handler. The issue is a possible out-of-bounds write caused by an integer overflow, enabling local escalation of privilege with root privileges required. Exploitation does not require user interaction. The available con...

CVE-2017-15818

CVE-2017-15818 describes an integer overflow in CAF-built Android stacks (Android for MSM, Firefox OS for MSM, QRD Android) when loading a user application in qseecom. The vulnerability arises in the Linux kernel path used by CAF and can occur if the application partition size rounds up to page_s...

CVE-2017-15833

CVE-2017-15833 affects Android on MSM builds (and related Firefox OS for MSM, QRD Android) with CAF Linux kernel, where untrusted pointer dereference in update_userspace_power() within the power driver can lead to information exposure. The description consistently links this issue to Qualcomm pow...

CVE-2017-15845

CVE-2017-15845 affects Android/CAF Qualcomm WLAN stack (Android for MSM, Firefox OS for MSM, QRD Android) with the Linux kernel, where an invalid (negative) user-space firmware size input during WLAN cal data store can cause memory leak or a buffer overflow. The root cause is a negative firmware ...

CVE-2017-18154

CVE-2017-18154 describes a local elevation-of-privilege issue in Android’s media stack: a crafted binder request can trigger an arbitrary unmap in MediaServer on CAF-based Android (Android for MSM, Firefox OS for MSM, QRD Android) via the Linux kernel. Public details in NVD/Android bulletins indi...

CVE-2017-6262

The CVE-2017-6262 entry concerns an Elevation of Privilege in the NVIDIA driver within Android, caused by a race condition leading to a use-after-free, which could allow unauthorized code execution at the local attacker level and escalate privileges. The vulnerability is classified as EoP/High im...

CVE-2018-11270

CVE-2018-11270 affects CAF builds for Android on MSM where a kernel path using devm_kzalloc can fail during probe, leading to automatic memory release by the kernel and potential data corruption. The description documents the root cause (memory management in the kernel) and the potential impact (...

CVE-2018-11273

The CVE-2018-11273 entry describes a double-free in voice_svc_dev when CAF’s Linux kernel device allocation hits cdev_alloc_err and device_destroy frees all resources. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF’s kernel. The root cause is that voice_svc_dev...

CVE-2018-11818

CVE-2018-11818 describes a race condition in CAF Android/Qualcomm MSM kernel drivers where LUT configuration is passed from userspace via ioctl and can race with LUT register updates in the kernel. Affected components include the MDSS/Display path in Android/Linux kernels used on Android for MSM ...