CVE-2018-5844

CVE-2018-5844 describes a use-after-free in the Qualcomm video driver’s set_output_buffers() where binfo can be accessed after it is freed in a failure path across CAF Android for MSM, Firefox OS for MSM, and QRD Android (Linux kernel). The vulnerability affects the video driver component and has...

CVE-2018-5847

CVE-2018-5847 describes a use-after-free condition arising from early/late retirement of rotation requests in CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Affected software is Android CAF kernel components; the underlying issue is a memory-managem...

CVE-2018-5857

In CVE-2018-5857, the issue is a Use-After-Free in the WCD CPE codec used by CAF Android releases (Android for MSM, Firefox OS for MSM, QRD Android) via the Linux kernel. The root cause is a memory management defect in wcd_cpe_core that can be triggered locally. The CVSS metrics indicate a Local ...

CVE-2018-5887

CVE-2018-5887 affects Android builds from CAF using the Linux kernel, where processing the USB StrSerialDescriptor array can trigger an array index out-of-bounds. The issue is tied to Android for MSM, Firefox OS for MSM, and QRD Android releases prior to the 2018-06-05 security patch level. The C...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2021-0465

CVE-2021-0465 affects the Android kernel component used by Pixel devices, specifically the GenerateFaceMask function in face.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with no extra execution privileges required and no user ...

CVE-2021-0488

CVE-2021-0488 affects Android with an out-of-bounds write in the nanopb-related code path (pb_write in pb_encode.c) due to a missing bounds check. The impact is local elevation of privilege, requiring local access and yielding System privileges; user interaction is not needed. Several connected s...

CVE-2025-36893

Google Pixel devices are affected by a vulnerability in the TPU component, specifically within the ReadTachyonCommands function of gxp_main_actor.cc . The root cause is the use of uninitialized data , which can lead to local information disclosure without requiring additional execution privileges...

CVE-2025-36937

CVE-2025-36937 affects the AudioDecoder::HandleProduceRequest path in audio_decoder.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, which could enable remote code execution over the network without user interaction or extra privileges. Multiple connected sources (incl...

CVE-2025-48624

CVE-2025-48624 is a local privilege-escalation vulnerability in the Linux kernel's ARM SMMU v3 driver (arm-smmu-v3.c) caused by improper input validation, leading to an out-of-bounds write in multiple functions. The issue could allow local escalation with no extra privileges and does not require ...

CVE-2026-0141

A missing bounds check in the decodeAppPacket function of RtcpAppPacket.cpp leads to a possible out-of-bounds (OOB) read . This vulnerability could result in remote information disclosure without requiring additional execution privileges or user interaction. The issue specifically affects the Tel...

CVE-2026-0156

CVE-2026-0156 describes a memory safety issue in checkSsrcCollisionOnRcv of RtpSession.cpp caused by a missing null check. This could allow remote denial of service without additional execution privileges, and exploitation does not require user interaction. The information appears consistently in...

CVE-2026-56920

A logic error in the s_decode_vui_param function within fw_hevc_dec_header.c leads to a possible out-of-bounds write . This vulnerability affects the VPU (Video Processing Unit) component on Google Pixel devices. Successful exploitation could result in Remote Code Execution (RCE) without requirin...

CVE-2014-9959

CVE-2014-9959 is described as an elevation of privilege vulnerability affecting Qualcomm closed‑source components within Android, specifically the Android kernel. The initial description notes an elevation of privilege with high/critical impact, but the connected documents only reiterate the exis...

CVE-2015-3830

Technical details for CVE-2015-3830 are not publicly available in the provided connected documents; monitor for updates.

CVE-2016-10233

CVE-2016-10233 is an elevation of privilege in the Qualcomm video driver affecting the Android kernel. The NVD entry documents a CRITICAL impact with a reported base score of 9.8 (CVSS3) and notes the vulnerability relates to the Qualcomm video driver; references include QC-CR#897452. Connected d...

CVE-2016-10234

CVE-2016-10234 describes an information-disclosure vulnerability in the Qualcomm IPA driver within the Android kernel. The issue could allow a local attacker to access data outside of normal permissions. The CVE is listed under the Android security bulletin with affected devices (Nexus 5X, Nexus ...

CVE-2016-11035

CVE-2016-11035 affects Samsung mobile devices with Exynos AP chipsets; a local user can trigger a kernel crash via the fb0(DECON) frame buffer interface. Connected sources reiterate this description, but no further technical details (affected versions, root cause specifics, exploit information, o...

CVE-2017-11074

CVE-2017-11074 affects Qualcomm WLAN in Android on MSM platforms (CAF-based kernels) via an obsolete set/reset ssid hotlist API in the WLAN stack. Root cause: legacy API left in kernel/UI interfaces enabling privilege escalation. Impact: as per CVSS, high confidentiality, integrity, and availabil...

CVE-2017-14901

CVE-2017-14901 describes a buffer overrun in the Qualcomm WLAN driver within Android for MSM/CAF Linux kernel when handling QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE with a TXPOWER_SCALE attribute of fewer than 1 byte. Affected components include Android devices using CAF/Linux kernel implement...

CVE-2017-15833

CVE-2017-15833 affects Android on MSM builds (and related Firefox OS for MSM, QRD Android) with CAF Linux kernel, where untrusted pointer dereference in update_userspace_power() within the power driver can lead to information exposure. The description consistently links this issue to Qualcomm pow...

CVE-2017-15845

CVE-2017-15845 affects Android/CAF Qualcomm WLAN stack (Android for MSM, Firefox OS for MSM, QRD Android) with the Linux kernel, where an invalid (negative) user-space firmware size input during WLAN cal data store can cause memory leak or a buffer overflow. The root cause is a negative firmware ...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...

CVE-2017-18051

CVE-2017-18051 affects Android for MSM, Firefox OS for MSM, and QRD Android builds based on CAF Linux kernel. The root cause is improper input validation of event->vdev_id in wma_rcpi_event_handler() (received from firmware), which can lead to an out-of-bounds memory read. This vulnerability i...

CVE-2017-8271

CVE-2017-8271 describes an out-of-bounds memory write in the MDSS Rotator driver used by Qualcomm components on Android CAF builds using the Linux kernel. The issue arises from an unsanitized userspace-controlled parameter, enabling a local attacker to cause memory corruption. The CVSS indicates ...

CVE-2017-9710

CVE-2017-9710 is described as a buffer overflow in the IOCTL path used to send QMI NOTIFY REQ messages in Android for MSM, Firefox OS for MSM, and CAF Android builds using the Linux kernel. The root cause is that the IOCTL interface can be invoked from multiple contexts, enabling a buffer overflo...

CVE-2018-11270

CVE-2018-11270 affects CAF builds for Android on MSM where a kernel path using devm_kzalloc can fail during probe, leading to automatic memory release by the kernel and potential data corruption. The description documents the root cause (memory management in the kernel) and the potential impact (...

CVE-2018-11818

CVE-2018-11818 describes a race condition in CAF Android/Qualcomm MSM kernel drivers where LUT configuration is passed from userspace via ioctl and can race with LUT register updates in the kernel. Affected components include the MDSS/Display path in Android/Linux kernels used on Android for MSM ...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2018-3598

In CVE-2018-3598, the affected components are Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels prior to the 2018-04-05 patch level. The root cause is insufficient validation of parameters from userspace in the camera_v2 driver, leading to an information...

CVE-2018-5821

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with CAF builds prior to the 2018-04-05 kernel patch level, CVE-2018-5821 is a memory error in wma_wow_wakeup_host_event() where wake_info->vdev_id from FW is used as an index into wma->interfaces, potentially reading beyond t...

CVE-2018-5828

Vulnerability CVE-2018-5828 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels prior to 2018-04-05. The issue is in function wma_extscan_start_stop_event_handler() where vdev_id is taken from firmware and not properly validated, potentially leading...

CVE-2018-5864

CVE-2018-5864 maps to a Qualcomm WMA information-disclosure vulnerability affecting Android devices (Pixel/Nexus) prior to the 2018-07-05 patch level. The issue arises during processing of WMI_APFIND events in CAF/Linux kernel-based Android builds, causing a potential buffer over-read and informa...

CVE-2020-0044

CVE-2020-0044 affects the Android FPC Fingerprint TEE in the Android kernel. In set_nonce of fpc_ta_qc_auth.c, there is an out-of-bounds read due to a missing bounds check, enabling local information disclosure with system execution privileges required. Exploitation is local and does not require ...

CVE-2020-0387

CVE-2020-0387 affects the SmartSpace package: in its manifest files there is a tapjacking vector caused by a missing permission check. The issue enables local elevation of privilege and possible account hijacking, with exploitation requiring user interaction. The vulnerability is categorized as a...

CVE-2025-36903

Google Pixel devices are affected by a security vulnerability in the lwis component. Due to improper input validation, the lwis_io_buffer_write function may allow for out-of-bounds (OOB) reads and writes . This flaw could enable a local elevation of privilege (EoP) without requiring additional ex...

CVE-2025-48637

CVE-2025-48637 affects the Android/Linux kernel code path mem_protect.c, where an integer overflow can cause an out-of-bounds write. This leads to local escalation of privilege with no additional execution privileges required and no user interaction needed. Multiple connected sources (Red Hat CVE...

CVE-2017-14894

CVE-2017-14894 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with the Linux kernel prior to the 2018-04-05 patch level. In wma_vdev_start_resp_handler(), the vdev_id received from firmware can exceed the maximum BSSID stored in wma_handle->interfaces, l...

CVE-2017-14914

CVE-2017-14914 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The issue arises when handles in the global client structure can become stale, per the NVD description. CVSS: 3.0/3.0 vector indicates Network attack, no user interaction, with High/CRITICAL...

CVE-2017-15830

CVE-2017-15830 affects the Qualcomm SME driver in Android on MSM (CAF Linux kernel lineage). The root cause is improper initialization of the ch_list array index in function sme_set_plm_request(), which can lead to a buffer overflow. The vulnerability is categorized as EoP (elevation of privilege...

CVE-2017-6423

CVE-2017-6423 is an elevation-of-privilege flaw in the Qualcomm Kyro L2 driver within the Android kernel. The vulnerability could allow a local attacker to execute arbitrary code with kernel privileges on affected devices (Pixel and Pixel XL are listed in the Android bulletin). The root cause is ...

CVE-2017-6424

CVE-2017-6424 is an elevation of privilege in the Qualcomm Wi‑Fi driver affecting Android kernel. Connected sources confirm a local exploit path in the Qualcomm Wi‑Fi stack and list affected devices as Nexus 5X, Nexus 6P, Nexus 9, Pixel C, Nexus Player with updates released for the 2017-04-01 pat...

CVE-2017-6425

CVE-2017-6425 is an information-disclosure vulnerability in the Qualcomm video driver embedded in the Android kernel. The issue affects Pixel and Pixel XL devices (and is tied to Qualcomm video components) and could allow a local attacker to access data outside of normal permission boundaries. Th...

CVE-2017-9708

The CVE-2017-9708 issue affects Android for MSM (and related CAF builds) in the camera driver. The race condition stems from msm_ois_power_down being invoked without a mutex, causing a race in the *reg_ptr variable within msm_camera_config_single_vreg. Impact is described as a race condition with...

CVE-2018-11261

Technical details about CVE-2018-11261 are not publicly provided in the supplied connected documents. Monitor for updates; no concrete affected products, versions, or fixes are confirmed in these sources.

CVE-2018-11275

CVE-2018-11275 affects Qualcomm/CAF Android boot components (Bootloader) across Android for MSM variants. The issue arises during image flashing via FastbootLib when the payload size is not divisible by the block size, causing an information disclosure. The vulnerability is characterized as a loc...

CVE-2018-11826

CVE-2018-11826 causes a buffer overflow in the WLAN ext scan handler due to a missing check for integer overflow during memory size calculations in CAF Android/Linux kernel components. Affected: Qualcomm WLAN HOST (Android CAF stack). The issue is documented across multiple sources (NVD entry and...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11909

CVE-2018-11909 describes an improper access-control issue in CAF-based Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel, where a device node/executable could be run from /cache/. The connected records do not provide concrete technical details about the vuln...

CVE-2018-11961

CVE-2018-11961 affects Qualcomm GPS_AP_LINUX (Android CAF/Linux kernel stack). Root cause: an out-of-bounds vector index when updating GNSS configurations. Impact: local access leading to potential elevation of privilege or code execution as indicated by CVSS metrics (CVSSv3: 7.8 HIGH; local vect...