CVE-2018-13906

CVE-2018-13906 involves a timing side-channel in the HMAC authentication of messages from QSEE on Qualcomm Snapdragon platforms, affecting a wide range of Snapdragon Auto/Compute/Connectivity/IoT/Wearables/Networking devices (many Snapdragon SoCs listed). Root cause: timing leakage allows an atta...

CVE-2018-11955

CVE-2018-11955: A missing length check on the reason-code in the payload can cause a driver to read memory outside the allocated frame, leading to an out-of-bounds read in Qualcomm/Snapdragon WLAN/driver components across Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon M...

CVE-2018-13907

The CVE-2018-13907 entry describes a vulnerability in Qualcomm/Snapdragon components where deserializing a key blob during key operations can trigger a buffer overflow, potentially exposing partial key information across a wide range of Snapdragon devices (IPQ4019, IPQ8074, MDM9... and many SD/So...

CVE-2018-13898

CVE-2018-13898 is an out-of-bounds write caused by an incorrect array index check in the PMIC across Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer, IoT, Industrial IOT, and various SDM/SD series). Root cause: improper bounds check on an array leading to write past the inte...

CVE-2019-2308

CVE-2019-2308 is described across connected docs as a kernel-level issue where fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages (CID-20c40794eb85), enabling a local escalation path to the fastrpc/DSP subsystem. The Astra Linux e...

CVE-2019-10529

CVE-2019-10529 is a use-after-free race in Qualcomm’s KGSL kernel path when marking user entries dirty via set_page_dirty, occurring if page->mapping is freed concurrently. It affects Snapdragon/KGSL GPU components and is associated with a documented exploit (exploit-db 46941). The provided do...

CVE-2019-2260

The CVE-2019-2260 entry describes a race condition in perf-event processing that can lead to a use-after-free condition affecting Qualcomm Snapdragon platforms (various Auto/Compute/IoT lines). Concrete details from connected documents identify the vulnerable component(s) as Qualcomm Snapdragon k...

CVE-2018-13896

CVE-2018-13896 affects Qualcomm closed-source components (XBL_SEC image authentication and related crypto checks) across Snapdragon platforms. Root cause: missing lock at the XBL_SEC stage allowing a compromised OEM XBL Loader to access image authentication and crypto validations. Impact per sour...

CVE-2019-10538

CVE-2019-10538 is a Qualcomm Qualcomm WLAN/modem/Linux-kernel-driver issue caused by a lack of check of address range received from firmware, allowing the modem to respond with arbitrary pages into the HLOS address space and potentially compromise the device OS. Affected stack includes Snapdragon...

CVE-2019-2261

CVE-2019-2261 describes information disclosure caused by unauthorized access from the GPU subsystem to HLOS/non-secure memory. The vulnerability affects Qualcomm devices across multiple Snapdragon families (e.g., IPQ8074, MDM9xxx, MSM8xxx, SD-series including SD625/SD820/SD835/SD845/SD850, SDM43x...

CVE-2019-10539

CVE-2019-10539 affects Qualcomm WLAN firmware in a wide range of Snapdragon chipsets (e.g., IPQ8074, MSM8xxx, QCA... and SD-series) where a missing length check when parsing the extended cap IE header length can trigger a buffer overflow. Reports describe this as a potential remote WLAN/firmware ...

CVE-2018-13924

The CVE-2018-13924 entry concerns a buffer length validation flaw that can take negative values, causing a stack overflow in Qualcomm components across many Snapdragon platforms (Auto/Compute/Connectivity/IOT/Industrial IOT, Mobile, Wearables, etc.) including IPQ8074 family and various SD/SM/QR s...

CVE-2019-2275

CVE-2019-2275 centers on a buffer overflow during deserialization of a key blob in Qualcomm Snapdragon firmware (multiple Snapdragon Auto/Compute/Connectivity/Secure elements). The issue arises when key operations are invoked and depends on CVE-2018-13907. Affected components include numerous Sna...

CVE-2019-2279

CVE-2019-2279 affects Qualcomm/Snapdragon components (e.g., Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT, Snapdragon Mobile, Wearables, and related SoCs such as MDM9150, MDM9607, MDM9650, various SDx/SDM/QCA families). Root cause: shared memory is updated with invalid data, causing me...

CVE-2019-2323

CVE-2019-2323 describes a lack of validation of user-passed crypto engine data, which can lead to a bus error in Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Voice & Music, Wearables) across numerous SDM/SDX/SD platforms. Root cause is uninitia...

CVE-2019-10541

CVE-2019-10541 affects Qualcomm Snapdragon platforms (various Snapdragon Auto/Compute/Consumer IoT/Industrial IoT/Mobile/Wearables) where a dereference on an uninitialized buffer can occur while parsing an FLV clip with corrupted codec-specific data. The issue stems from improper handling during ...

CVE-2019-2235

CVE-2019-2235 affects Qualcomm Snapdragon platforms listed in the vulnerability details. A buffer overflow occurs when the emulated RPMB is used, caused by sector-size assumptions in the trusted application (TA) rollback protection logic. The vulnerability impacts confidentiality, integrity, and ...

CVE-2019-2333

Technical details about CVE-2019-2333 are not publicly provided in the supplied documents. Monitor for updates as more specifics (affected components, root cause, remediation) may be disclosed in future disclosures.

CVE-2019-10492

CVE-2019-10492 describes a vulnerability in boot image verification where AVB verification can be bypassed for Qualcomm Snapdragon-based platforms (Snapdragon Auto, Mobile, Wearables) across multiple SoCs (MDM9607, MSM8909W, Qualcomm 215, SD series and SDM439). The issue is a local vulnerability ...

CVE-2019-10497

Technical details about CVE-2019-10497 are not publicly provided in the supplied documents. No specifics on affected products, root cause, or fixes are available here. Monitor for updates.

CVE-2019-2287

CVE-2019-2287 involves an improper validation in inputs received from firmware that can cause an out-of-bounds write in the video driver within Qualcomm Snapdragon components (across many Snapdragon Auto/Compute/IoT/mobile/wearables families). The issue is tied to the video subsystem and has been...

CVE-2019-10491

CVE-2019-10491 affects Qualcomm ADSP (Audio DSP) across a broad set of Snapdragon platforms (e.g., IPQ4019, IPQ8064, IPQ8074, MDM9150/9206/9607/9640/9650, MSM8909W/8996AU, QCS405/605, SD-series like SD 210–435/439, SD 450, 615/16/625/632/636/665/675, 712/710/670, 730, 820/820A, 835, 845/850, 855,...

CVE-2019-2246

CVE-2019-2246: A memory-corruption issue where thread start can trigger invalid memory writes in the kernel due to a user-provided argument, affecting Qualcomm Snapdragon-based devices (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon Mobile across numerous SoCs). Root cause: improper handl...

CVE-2019-10533

CVE-2019-10533 describes an out-of-bounds access due to improper validation of an array index that corrupts an index table entry in Qualcomm/Snapdragon components (numerous SoCs and modems across Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables portfolios). Conne...

CVE-2019-10531

CVE-2019-10531 describes an incorrect reading of the system image that results in a buffer overflow when the system image size is increased, affecting Snapdragon Auto, Mobile and Wearables platforms (MDM9607, MSM8909W, Qualcomm 215, SD 210/212/205, SD 425, 439/429, 450, 625, 632, SDM439 and relat...

CVE-2019-2330

CVE-2019-2330 describes an issue with improper input validation in the allocation request for secure allocations, which can lead to a page fault on Qualcomm hardware. Affected products span multiple Qualcomm platforms (e.g., Snapdragon Auto/Compute/Mobile/IoT, IPQ4019/IPQ8064/IPQ8074, MDM9xxx, SD...

CVE-2019-10504

CVE-2019-10504 affects Qualcomm Snapdragon firmware components (multiple Snapdragon Auto/Consumer IoT/Industrial IoT devices and related SoCs). Root cause: resource consumption leads to firmware not delivering EXT scan response to host within 1 second, impacting availability. Affected products in...

CVE-2019-2258

CVE-2019-2258: Improper validation of array index causes out-of-bounds write and memory corruption in MMCP within Qualcomm Snapdragon family devices (Auto, Compute, IoT, Wearables, etc.). Impact spans numerous Snapdragon platforms (MDM9xxx, SDX20, SDM6xx/8xx, etc.), across multiple SoCs listed in...

CVE-2019-2273

CVE-2019-2273: IOMMU page fault when playing H.265 video files causes denial of service on Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity/IoT, Mobile, Wearables) across listed SoCs (MSM8909W, QCS605, SD 210/212/205, SD 425/427/430/435/439/ SD 429, SD 450, SD 625/650/652...

CVE-2019-10502

CVE-2019-10502 is a stack overflow vulnerability described across multiple Qualcomm Snapdragon camera implementations. The issue arises when an index equal to the I/O buffer size is accessed within the camera module, affecting a wide range of Snapdragon Compute, Snapdragon Consumer IoT, Snapdrago...

CVE-2019-10522

CVE-2019-10522 affects a wide range of Qualcomm Snapdragon devices across multiple SoCs (e.g., SD 210/212/205, 625, 665, 710/670, 820/820A, 835/850, 855, and many others) due to a nonstandard buffer overflow in the clip parsing path. The issue is triggered while playing a clip and could impact co...

CVE-2019-2283

An out‑of‑bounds access vulnerability in Qualcomm Snapdragon devices results from improper validation of the read/write index of TX/RX FIFOs before pointer calculation. The issue affects a broad set of Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Weara...

CVE-2019-2314

CVE-2019-2314 describes a race condition that can cause a use-after-free when writing to two sysfs entries in Qualcomm/Snapdragon components. Affected are Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables acro...

CVE-2019-2327

CVE-2019-2327 describes a possible buffer overflow when playing a clip with an incorrect element size affecting a wide range of Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and related SDM/SD/ Snapdragon families). T...

CVE-2019-2334

CVE-2019-2334 is a null pointer dereference in Snapdragon media handling that can occur when playing a clip with a wrong block group id, affecting a broad set of Qualcomm Snapdragon products (Auto, Compute, IoT, Mobile, Wearables, etc.). The NVD and Red Hat entries rate it as HIGH severity with C...

CVE-2019-10489

CVE-2019-10489 involves a possible null-pointer dereference when parsing an AVI clip during copy in Qualcomm Snapdragon drivers across many Snapdragon products. Root cause: null pointer in parsing/copy path. Impact: high, with potential crash (availability) and no confidentiality/integrity impact...

CVE-2019-10524

CVE-2019-10524 involves a lack of validation for a negative value returned by get_clk, which is misinterpreted as a valid pointer, causing a use-after-free in the Qualcomm clk driver across numerous Snapdragon platforms (e.g., Snapdragon Auto/Mobile/IoT variants). The issue enables local exploita...

CVE-2019-2236

CVE-2019-2236 is a null pointer dereference during secure application termination when using specific application IDs. Affected vendors/products (as listed in the description) include Qualcomm Snapdragon families and multiple Snapdragon platforms (e.g., IPQ8074, MDM9xxx, SD 4xx–430/625/820, 8CX, ...

CVE-2019-2239

CVE-2019-2239 is a Qualcomm/Snapdragon-related issue where sanity checks are missing in layout, potentially causing SUI corruption or denial of service. Affected families span Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (e.g., MDM9150, SD 210/212/205, SD 410/12, SD 62...

CVE-2019-2341

CVE-2019-2341 describes a buffer overflow in the audio subsystem when a user-provided audio buffer size exceeds the maximum allowed. Affected: Snapdragon SoCs and families listed in the entry (e.g., Snapdragon Auto/Compute/IoT, Snapdragon Mobile, Wearables, etc.). Root cause: unchecked size in au...

CVE-2019-2253

CVE-2019-2253 is a buffer over-read that can occur when parsing a corrupted OGG comment block in Qualcomm Snapdragon devices (listed families). The root cause is parsing a stream with malformed metadata leading to reading beyond bounds. The description and connected documents do not provide expli...

CVE-2019-2301

CVE-2019-2301 involves a potential out-of-bounds read when an SPI-id is not within the FIFO range in Qualcomm Snapdragon devices (Auto/Compute/IoT/Wearables/Networking lines across IPQ4019, IPQ8064, MSM89xx, QCA/N/QCS, and SD/SDM series). The root cause is an SPI path feeding a FIFO with an out-o...

CVE-2019-10496

CVE-2019-10496 involves a lack of checking a variable received from a driver when populating a Firmware data structure, causing a buffer overflow. Affects Qualcomm Snapdragon families including Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables and a b...

CVE-2019-2285

CVE-2019-2285 describes an out-of-bounds write bug in Qualcomm Snapdragon media handling related to reporting properties during video playback. Affected are Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables platforms across numerous SDM/SD vari...

CVE-2019-2294

CVE-2019-2294 relates to a vulnerability in Qualcomm Snapdragon components where a hard-coded magic number is used to calculate heap guard bytes. This can allow an attacker to corrupt heap blocks without understanding the heap’s algorithm, affecting a wide range of Snapdragon-based products (Auto...

CVE-2019-2328

CVE-2019-2328 describes a potential buffer overflow when the number of channels exceeds the size of the channel mapping array in Qualcomm/ Snapdragon audio-related components (across multiple Snapdragon families). The vulnerability is listed under Qualcomm Audio in the 2019 Android security conte...

CVE-2019-2343

The CVE-2019-2343 entry concerns out-of-bounds reads and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver within Qualcomm Snapdragon firmware across numerous SoCs and platforms (Snapdragon Auto, Compute, Connectivity, C...

CVE-2019-10495

CVE-2019-10495 describes an arbitrary buffer write during processing of sequence headers for HEVC/AVC encoding in Qualcomm Snapdragon SoCs (wide range of Snapdragon Auto/Compute/Connectivity/IoT devices). The vulnerability is caused by a buffer-write flaw in the encoder path; vulnerable component...

CVE-2019-10498

CVE-2019-10498 describes a buffer overflow in a Qualcomm closed‑source component triggered when a client sends more than 5 io_vec requests to the server. Affected products span Snapdragon Auto/Compute, Snapdragon IoT devices, and related Snapdragon/SDM families (e.g., SD 210–855, various Snapdrag...

CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...