CVE-2021-1905

CVE-2021-1905 is a memory-management vulnerability (use-after-free) in Qualcomm Snapdragon chipsets caused by improper handling of memory mapping across multiple processes. Affects a broad range of Snapdragon products (Auto, Compute, Connectivity, IoT, Mobile, Wearables, etc.). The CVE is charact...

CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2019-14113

CVE-2019-14113 is a buffer overflow in WLAN firmware when unwraping data with CCMP during EAPOL handshake parsing across Qualcomm Snapdragon hardware (APQ/SDM/QCA platforms). The issue affects a wide range of Snapdragon devices and SoCs (e.g., APQ8009, SDM630/636/660/670/710/845/850, QCA, Nicobar...

CVE-2022-22071

CVE-2022-22071 describes a use-after-free condition in Qualcomm Snapdragon chipsets where process shell memory is freed via IOCTL munmap during initialization. Affected lines include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music families. The vuln...

CVE-2018-5913

Technical details about CVE-2018-5913 are not publicly provided in the supplied documents. No affected product/version or remediation information is stated here. Monitor the sources for updates.

CVE-2022-22065

CVE-2022-22065 is a Qualcomm Snapdragon WLAN-Host vulnerability characterized by an out-of-bounds read due to an improper length check, leading to Denial of Service. The CVE is listed under Qualcomm components for the May 2022 Android security updates as a High-severity WLAN issue. Connected sour...

CVE-2021-1931

CVE-2021-1931 is a buffer overflow in Qualcomm SDM660 bootloader processing of fastboot/flash data. The exploit arose from improper handling of large payloads in the bootloader’s flash: command, enabling memory corruption that could bypass signature checks and unlock the bootloader on SDM660 devi...

CVE-2020-3702

CVE-2020-3702 affects the Linux kernel (ath9k wireless driver) and can lead to information disclosure via specially crafted WLAN traffic. Multiple connected sources confirm the flaw in the Atheros IEEE 802.11n chipsets driver and its potential for information leakage. Debian LTS advisories (DSA-4...

CVE-2022-22080

The CVE-2022-22080 entry concerns Qualcomm Snapdragon firmware: improper validation of a backend id in the PCM routing process can cause memory corruption across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music components. Root cause is memory-corrup...

CVE-2018-11942

CVE-2018-11942 describes a vulnerability where failure to initialize the reserved memory sent to the firmware may cause exposure of 1 byte of uninitialized kernel SKB memory to the firmware in multiple Qualcomm/Qualcomm-supplied platforms (e.g., Snapdragon Auto, Snapdragon Mobile, IPQ4019, IPQ806...

CVE-2018-13906

CVE-2018-13906 involves a timing side-channel in the HMAC authentication of messages from QSEE on Qualcomm Snapdragon platforms, affecting a wide range of Snapdragon Auto/Compute/Connectivity/IoT/Wearables/Networking devices (many Snapdragon SoCs listed). Root cause: timing leakage allows an atta...

CVE-2018-11955

CVE-2018-11955: A missing length check on the reason-code in the payload can cause a driver to read memory outside the allocated frame, leading to an out-of-bounds read in Qualcomm/Snapdragon WLAN/driver components across Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon M...

CVE-2019-10567

CVE-2019-10567 affects Qualcomm Adreno GPU kernel driver (KGSL) where a randomized scratch buffer in the global shared mappings is used to store the RPTR for the ringbuffer. The attack leverages the RPTR read from scratch to influence ringbuffer space checks, allowing an attacker-controlled RPTR ...

CVE-2018-5903

CVE-2018-5903 is an out-of-bounds read caused by improper validation of an array when processing the VDEV stop response in Qualcomm WLAN firmware (qcacld 3.0). Affected products span Qualcomm/Snapdragon platforms including Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd...

CVE-2018-11947

CVE-2018-11947 concerns a double-free in the txrx stats request during pdev detach as the host driver unloads on Snapdragon platforms (multiple Snapdragon Mobile/IoT/industrial devices and various Qualcomm/QCS/QCA/SDM families). The description notes a potential use-after-free style issue in the ...

CVE-2018-13907

The CVE-2018-13907 entry describes a vulnerability in Qualcomm/Snapdragon components where deserializing a key blob during key operations can trigger a buffer overflow, potentially exposing partial key information across a wide range of Snapdragon devices (IPQ4019, IPQ8074, MDM9... and many SD/So...

CVE-2021-35117

CVE-2021-35117 is associated with Qualcomm Snapdragon WLAN components. Description indicates an out-of-bounds read may occur while processing an IBSS beacon across multiple Snapdragon lines (Auto, Compute, Connectivity, C.I.O.T., Industrial IOT, Mobile, Voice & Music). The CVE is listed in Qualco...

CVE-2022-22068

CVE-2022-22068 affects Qualcomm/ Snapdragon kernel components. The issue arises when a kernel event contains content not generated by NPU software during asynchronous execution, potentially enabling local escalation of privileges with high impact (confidentiality, integrity, and availability all ...

CVE-2022-22072

CVE-2022-22072 is a buffer overflow caused by improper validation of NDP application information length in Qualcomm Snapdragon family components (including Auto, Compute, CE Connectivity, CIOT, Industrial IOT, Mobile, Voice & Music) and related WLAN subsystems. The vulnerability is locally exploi...

CVE-2021-35105

CVE-2021-35105 is a graphics profiling input-validation issue leading to possible out-of-bounds access in Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Vision/Music, Wearables). Connected sources attribute the flaw to improper input handling in...

CVE-2022-22088

CVE-2022-22088 is a memory corruption vulnerability in the Qualcomm Bluetooth HOST component caused by a buffer overflow while parsing a remote command response. Reported in the Qualcomm January 2023 Security Bulletin, the issue affects devices using certain Qualcomm chipsets and has a CVSS of 9....

CVE-2020-11239

CVE-2020-11239 describes a use-after-free when importing a DMA buffer using the CPU address due to an attachment not being cleaned up. Affected are Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root caus...

CVE-2021-30351

CVE-2021-30351 is an out-of-bounds memory access in Qualcomm/Snapdragon audio decoders triggered by improper validation of the number of frames during music playback. The NVD entry and Red Hat bulletin describe a critical issue with CVSS 3.1 score of 9.8 (NETWORK, LOW attack complexity, NONE priv...

CVE-2021-30334

CVE-2021-30334 describes a use-after-free in Qualcomm Snapdragon DRM handling caused by a missing null check of DRM file status after the file structure is freed. Affected products include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Voice & Music, and Wearables. The vuln...

CVE-2021-35106

CVE-2021-35106 describes a Qualcomm Snapdragon vulnerability caused by an improper length calculation of a WMI message, leading to a possible out-of-bounds read. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables. The ...

CVE-2018-13898

CVE-2018-13898 is an out-of-bounds write caused by an incorrect array index check in the PMIC across Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer, IoT, Industrial IOT, and various SDM/SD series). Root cause: improper bounds check on an array leading to write past the inte...

CVE-2021-35068

CVE-2021-35068 involves a NULL pointer dereference caused by a missing null check when freeing the device information buffer in the Bluetooth HFP protocol. Affected product families are Qualcomm Snapdragon lines: Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Voice & Music, and Wearab...

CVE-2021-1945

CVE-2021-1945 describes a possible out-of-bounds read in Qualcomm Snapdragon firmware, caused by a missing length check for the Bandwidth-NSS IE across multiple Snapdragon lines (Auto/Compute/Connectivity/IoT/Industrial IoT/Mobile/Voice & Music/ Wired Infrastructure). The vulnerability affects Qu...

CVE-2021-35069

CVE-2021-35069 describes an improper validation of data length received from a DMA buffer that can cause memory corruption in Qualcomm Snapdragon products. Affected families include Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and WIN (Snapdragon ha...

CVE-2022-25743

CVE-2022-25743 is a memory corruption via use-after-free in KGSL during graphics buffer import on Qualcomm Snapdragon GPUs (multiple Snapdragon lines). Affected component is graphics driver; root cause is use-after-free leading to potential memory corruption with high impact. CVSS vectors indicat...

CVE-2018-11929

CVE-2018-11929 describes a heap/overflow risk from lack of input validation in WLAN handling within Qualcomm-derived SDP/APIs. Public documents (NVD, Red Hat, CNVD, CVE listings) tie the issue to Qualcomm Snapdragon families (e.g., Auto, Consumer IOT, Industrial IOT, Mobile, Voice & Music) across...

CVE-2018-13919

CVE-2018-13919 is a use-after-free vulnerability that can occur when resetting the routing table if an invalid rule id is encountered during the reset command. Affected devices span Qualcomm Snapdragon platforms including Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon C...

CVE-2020-11272

CVE-2020-11272 is a high-severity flaw affecting Qualcomm WLAN components in Snapdragon-based devices. The root cause is a use-after-free condition caused by deleting an entry in a hash table before enqueuing a frame to the PE queue, which can lead to use of a stale object. Documented impact span...

CVE-2018-13908

CVE-2018-13908 affects Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity families across numerous SoCs). The issue is a truncated access authentication token that weakens access control for stored secure application data, enabling local attacker access with partial confide...

CVE-2022-33213

CVE-2022-33213 refers to a memory corruption in a Qualcomm closed‑source modem component triggered by a buffer overflow while processing a PPP packet. Affected asset class: Qualcomm modem (closed‑source) within Snapdragon devices; underlying cause: memory corruption due to buffer overflow; potent...

CVE-2019-2257

CVE-2019-2257 involves wrong permissions in a configuration file, enabling unauthorized permissions on numerous Qualcomm Snapdragon platforms. Affected families include Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and related configurations a...

CVE-2018-5883

CVE-2018-5883 describes a buffer overflow in WLAN driver event handlers caused by improper validation of array index. Affected products include Qualcomm Snapdragon family devices such as MDM9206/9607/9640/9650, MSM8996AU, QCS405/QCS605, SD 636/675/730/820A/835/855, SDA660, SDM630/660/SDX20/SDX24,...

CVE-2022-33280

CVE-2022-33280 describes a memory corruption in the Bluetooth HOST when processing AVRCP packets due to an uninitialized pointer. The issue is attributed to Qualcomm components (Bluetooth) and is listed across multiple feeds (NVD, Red Hat, CVE.org, CNNVD, etc.) as a memory corruption vulnerabilit...

CVE-2020-11240

CVE-2020-11240 describes a memory corruption issue in Qualcomm Snapdragon components triggered by an ioctl command with an incorrect copy size. The vulnerability affects a broad set of Snapdragon products (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables...

CVE-2020-11290

CVE-2020-11290 is a use-after-free in Qualcomm MSM ioctl event handling caused by a race between ioctl register and deregister. Affected are Snapdragon products including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Wearables. The issue stems from contention in the ioctl...

CVE-2022-33255

CVE-2022-33255 is a buffer over-read information-disclosure issue in the Bluetooth HOST when processing GetFolderItems and GetItemAttribute Cmds from a peer device. The CVE is listed in Qualcomm’s security bulletin with a High severity for Bluetooth, and is described as a information-disclosure v...

CVE-2021-1940

CVE-2021-1940 affects Qualcomm Snapdragon devices across multiple product lines. The root cause is improper handling of responses from firmware, leading to a use-after-free condition that can impact confidentiality, integrity, and availability. The connected documents confirm the issue and impact...

CVE-2021-30317

CVE-2021-30317: Root cause is improper validation of program headers containing ELF metadata. The connected document set confirms impact as image verification bypass on Qualcomm/ Snapdragon-based platforms, specifically within Qualcomm closed‑source components. The vulnerability is categorized as...

CVE-2021-30324

CVE-2021-30324 describes an out-of-bounds write caused by missing boundary checks for the maximum buffer size when sending a DCI packet to a remote process in Qualcomm Snapdragon family components (e.g., APQ8096AU, IPQ4… and many QCA/IQ/QCS/SD devices). Root cause: lack of boundary checking leads...

CVE-2019-2308

CVE-2019-2308 is described across connected docs as a kernel-level issue where fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages (CID-20c40794eb85), enabling a local escalation path to the fastrpc/DSP subsystem. The Astra Linux e...

CVE-2021-1955

CVE-2021-1955 describes a Denial of Service in Qualcomm’s Snapdragon stack caused by improper handling of connections when an association is rejected. The issue affects Snapdragon Auto/Compute/Connectivity and related Snapdragon lines (IoT, Wearables, Mobile, etc.). Root cause: mishandling of con...

CVE-2022-22075

CVE-2022-22075 concerns Information Disclosure in Graphics during GPU context switch, with affected component listed as Qualcomm Display. The CVE is documented in multiple sources, including NVD and Qualcomm security references, indicating a vulnerability in the graphics/GPU context switch pathwa...

CVE-2022-40537

CVE-2022-40537 is a memory corruption issue in the Bluetooth HOST when handling the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response. The connected sources identify this as affecting Qualcomm Bluetooth components (e.g., Snapdragon) and classify the issue under Bluetooth with a high/critical impa...

CVE-2021-1970

CVE-2021-1970 relates to an out-of-bounds read in Qualcomm WLAN/Qualcomm Snapdragon subsystems caused by insufficient length checks for FT sub-elements. Affected products include Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music lineages and WLAN components. Th...