CVE-2019-14113

CVE-2019-14113 is a buffer overflow in WLAN firmware when unwraping data with CCMP during EAPOL handshake parsing across Qualcomm Snapdragon hardware (APQ/SDM/QCA platforms). The issue affects a wide range of Snapdragon devices and SoCs (e.g., APQ8009, SDM630/636/660/670/710/845/850, QCA, Nicobar...

CVE-2019-10567

CVE-2019-10567 affects Qualcomm Adreno GPU kernel driver (KGSL) where a randomized scratch buffer in the global shared mappings is used to store the RPTR for the ringbuffer. The attack leverages the RPTR read from scratch to influence ringbuffer space checks, allowing an attacker-controlled RPTR ...

CVE-2020-11125

CVE-2020-11125 affects Qualcomm/Snapdragon platforms (Kernel) with an out-of-bounds access in the MHI command processing due to insufficient channel-id validation. The vulnerability is listed in Android/Qualcomm bulletin context (kernel path) for multiple SnapdragonSoCs and was tracked in CVE-202...

CVE-2020-11162

CVE-2020-11162 describes a possible buffer overflow in the MHI driver due to missing validation of EOT events in Qualcomm Snapdragon SoCs (OEMs include Snapdragon Auto/Compute/Connectivity etc.). Root cause: lack of input parameter validation on EOT events received from the MHI device side; impac...

CVE-2019-14060

CVE-2019-14060 is a vulnerability described as uninitialized stack data usage when memory for a blob is not allocated or is smaller than the required struct, caused by a missing check of the return value for read/write blob operations in Qualcomm Snapdragon components (Android/Snapdragon Auto, Co...

CVE-2020-11173

CVE-2020-11173 describes a race condition caused by two threads running from user space in Qualcomm/ Snapdragon fastRPC driver. Public records show this vulnerability as affecting Qualcomm Kernel components with high severity (local) and is listed in CVE-2020-11173 across multiple vendor advisori...

CVE-2019-14041

CVE-2019-14041 affects Qualcomm Snapdragon platforms (listed APQ, SDM, SM etc.) in kernel components. The issue is a buffer overrun caused by a lack of buffer size verification when updating the message buffer with physical address information during listener modified response processing. The vul...

CVE-2020-3703

The connected Red Hat CVE entries confirm a concrete BLE Link Layer handling flaw: Cypress PSoC 4 BLE component

CVE-2020-11118

CVE-2020-11118 is an information-exposure issue tied to processing of IE headers (beacon IE frame) on Qualcomm Snapdragon platforms. The NVD entry lists affected families (Snapdragon Auto, Compute, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Mobile, Wearables, etc.) and a lon...

CVE-2020-3656

CVE-2020-3656 affects Qualcomm Snapdragon devices with MHI command processing, where an out-of-bounds access can occur due to insufficient validation of the MHI command channel id from devices (notably across a broad list of Snapdragon platforms). The root cause is lack of proper channel-id check...

CVE-2019-10527

CVE-2019-10527 affects Snapdragon Auto/Compute/Connectivity and related Snapdragon families. The root cause is manipulation of the SMEM (shared memory) partition in a scenario where the HLOS is compromised, which can allow access to memory outside the SMEM address range and lead to memory corrupt...

CVE-2019-10579

CVE-2019-10579 affects Qualcomm Snapdragon devices (wide range listed in the description) where a buffer over-read can occur while playing a video clip. The underlying issue is a video decoding over-read in affected Snapdragon components (Auto/Compute/Connectivity/IoT families). Public references...

CVE-2019-14003

CVE-2019-14003 describes a NULL pointer dereference during MKV parsing where cue information is parsed before segment information in Snapdragon-based devices (a wide set of Snapdragon Auto/Compute/Connectivity/IoT/Wearables platforms). The issue is triggered when parsing invalid MKV clips and aff...

CVE-2019-10590

CVE-2019-10590 concerns an out-of-bounds access when parsing a dts atom in Qualcomm/Snapdragon components (closed-source). Affected products are listed in the initial record and include Snapdragon Auto, Compute, Connectivity, IoT, Wearables and related Snapdragon families across numerous SoCs (e....

CVE-2020-11124

CVE-2020-11124 is a use-after-free in the Qualcomm Snapdragon diag client map table caused by reallocation of the list when the max client limit is exceeded. Affected are Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, Mobile, and related Qualcomm platforms (e.g., MDM9607, Nicobar, QCS404...

CVE-2019-14057

CVE-2019-14057 is a buffer over-read in the codec private data while parsing MKV files, triggered by missing buffer-size validation during read in Qualcomm Snapdragon platforms (including Snapdragon Auto/Compute/Connectivity, IoT variants, and related SoCs such as APQ8xxx, SDM/SM series). Root ca...

CVE-2019-14063

CVE-2019-14063 concerns an out-of-bounds access caused by invalid inputs to the DAPM mux settings, producing kernel failures on Qualcomm Snapdragon platforms. Affected products include Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon...

CVE-2020-11115

CVE-2020-11115 is a buffer over-read in processing information elements from beacons due to missing input validation in the Snapdragon wireless stack affecting a wide range of Snapdragon platforms (e.g., APQ8009, APQ8053, APQ8096AU, SDM450/660/845, QCA61xx/QCM21x family, SXR2130, and others). The...

CVE-2019-14005

CVE-2019-14005 describes a buffer overflow during clip playback in Snapdragon Auto/Compute/Connectivity and related Snapdragon families (APQ800x to SXR2130). The root cause is a missing size duration check, enabling potential memory corruption when processing certain clips. Affected products span...

CVE-2019-14010

CVE-2019-14010 is documented with concrete details in Qualcomm components as a vulnerability affecting Snapdragon devices. The issue arises when a tool or application fails while mapping the first buffer and then maps a second buffer at the same physical address, potentially causing the device to...

CVE-2019-14017

CVE-2019-14017 describes a heap buffer overflow while parsing invalid MKV clips with malformed Vorbis data in Snapdragon hardware and Qualcomm software stacks. Affected are a wide range of Qualcomm/Snapdragon devices and components (e.g., Snapdragon Auto/Compute/Connectivity, IoT lines, and Qualc...

CVE-2019-14024

CVE-2019-14024 is a stack-use-after-scope issue in the NFC card-emulation use case (Qualcomm Snapdragon NFC). Linked sources identify the affected area as Qualcomm NFC components and note publication in Qualcomm’s security bulletin with a quest for patches (QC-2494103). The CVE is referenced in R...

CVE-2019-10581

CVE-2019-10581: NULL is assigned to a local audio device pointer after free instead of a global static pointer, enabling a use-after-free vulnerability in Qualcomm Snapdragon platforms. Affected families include Snapdragon Auto, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables, cove...

CVE-2019-14023

CVE-2019-14023 describes a string format issue in HLOS data processing that could allow local exploitation on Qualcomm Snapdragon targets. The vulnerability arises from inputs not being NULL-terminated before string copy in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snap...

CVE-2020-11120

CVE-2020-11120 is a use-after-free vulnerability in Snapdragon components where the data buffer passed to a callback may be freed by the calling thread and become invalid when the event loop runs, enabling potential memory/data corruption. Affected devices span multiple Snapdragon families (APQ80...

CVE-2019-14013

CVE-2019-14013 affects Snapdragon SoCs (listed family) and is triggered by parsing of an invalid super index table, potentially causing invalid data to be read into the table. The NVD entry rates it as CRITICAL (CVSS 3.1: 9.8) with NETWORK attack vector, no user interaction, and high impact on co...

CVE-2019-14034

CVE-2019-14034 affects Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables) across listed SoCs. The issue is a use-after-free during EEPROM query processing, with a path that may fail to unlock a mutex after an error, potentially...

CVE-2019-10578

The CVE-2019-10578 issue is a null pointer dereference that can occur while parsing a clip, affecting a broad set of Qualcomm Snapdragon products (Auto/Compute/Connectivity/IoT lines) and various SoCs (e.g., APQ8xxx, MSM/SDX families) as listed in the initial description. The root cause is a cras...

CVE-2019-14004

CVE-2019-14004 is a buffer overflow in the MKV/EBML handling path affecting numerous Qualcomm/Snapdragon platforms (e.g., APQ80xx/SDM/SM… families) when processing an invalid MKV clip with an invalid EBML size. Public sources (NVD, Red Hat, CVE listing) describe the issue as a buffer overflow in ...

CVE-2019-14006

CVE-2019-14006 describes a buffer overflow in clip playback due to missing offset length checks in multiple Qualcomm Snapdragon components (e.g., Snapdragon Auto/Compute/Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Wearables) across numerous Qualcomm platforms (APQ8xxx, SDM/SM series,...

CVE-2020-3654

CVE-2020-3654 is a buffer overflow in Qualcomm closed‑source components (Qualcomm/ Snapdragon) where SIP message processing fails to validate an index before copying data. The vulnerability is rated Critical (CVSS v3.1/10.0) with network access and no user interaction, implying potential remote c...

CVE-2020-3673

CVE-2020-3673 is a vulnerability reported in Qualcomm closed-source components affecting Snapdragon/Qualcomm stack. The issue is a buffer overflow during SIP message processing where values are stored in an array without validating the index length, enabling potential arbitrary code execution wit...

CVE-2019-14042

CVE-2019-14042 affects Qualcomm Snapdragon families (multiple SoCs) with an out-of-bounds read in the fingerprint application caused by data being assigned to a local buffer without a length check. This is a component in Snapdragon Auto, Compute, Connectivity, IoT, Mobile, and related Snapdragon ...

CVE-2019-14072

CVE-2019-14072 describes a race condition in Qualcomm/Snapdragon kernel/JPU handling leading to an unhandled paging request by dereferencing a freed object due to concurrent sparse free and sparse bind ioctls. Affected are Snapdragon Auto/Compute/IoT/Wearables platforms across numerous SoCs (e.g....

CVE-2019-13994

CVE-2019-13994 concerns memory corruption and potential information leakage caused by a missing validation: the current received data fragment size read from shared memory is not checked to be less than the actual packet size. This affects a wide range of Qualcomm Snapdragon families and devices ...

CVE-2020-3641

CVE-2020-3641 is a Qualcomm closed‑source component issue (Snapdragon) involving an integer overflow when atom size is smaller than atom offset due to improper validation. Affected products span Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables across numerous SoC...

CVE-2019-10553

CVE-2019-10553 affects Qualcomm Snapdragon platforms. The issue is multiple read overflows caused by improper length checks during authentication decoding in Cs domain/RAU Reject and TC cmd paths. Affected products span extensive Snapdragon families (APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU,...

CVE-2019-14077

CVE-2019-14077 is a memory-about-out-of-bounds issue in Snapdragon SoCs where an ese transmit command can corrupt memory by using a user-supplied Response buffer. Affected products span Qualcomm-based hardware in Snapdragon Auto/Compute/Connectivity/IoT/Industrial IoT, including various Snapdrago...

CVE-2019-14074

CVE-2019-14074 describes a heap overflow in the diag command handler caused by missing packet-length validation, affecting numerous Qualcomm Snapdragon platforms (e.g., APQ8009, SDM8xx/9x, and other Snapdragon families). The issue is localized (local attacker) and is described in public CVE listi...

CVE-2020-3690

CVE-2020-3690 describes that an incorrect SMMU configuration in the modem crypto engine could potentially compromise the hypervisor on Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wired Networking) across listed SoCs (A...

CVE-2019-10549

CVE-2019-10549 is a null pointer dereference caused by improper validation of the CSEQ header response over the network in Qualcomm Snapdragon firmware across multiple Snapdragon variants (Auto, Compute, IoT, Mobile, Wearables). The NVD CVSS shows both network attack vector, low complexity, and h...

CVE-2020-11164

CVE-2020-11164 describes a privilege-escalation issue in Qualcomm Snapdragon platforms where a third-party app can call broadcasts in Perfdump, abusing access controls. Affected products include Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, Mobile, Wearables across numerous SoCs (e...

CVE-2020-3645

CVE-2020-3645 affects Qualcomm/Qualcomm-based WLAN firmware used across Snapdragon Compute, Connectivity, Consumer Electronics Connectivity, Consumer IoT, Industrial IoT, Mobile, and related SoCs (e.g., IPQ6018, IPQ8074, Kamorta, Nicobar, QCA63xx, QCN7xxx, SC7xxx, SDM8xx, SXR1x0, etc.). The vulne...

CVE-2019-10550

The CVE-2019-10550 issue affects Qualcomm Snapdragon line devices (e.g., various Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Wearables families) where a buffer over-read occurs when a UE processes a network-received message without zero termination. The root cause is a missing ze...

CVE-2019-10629

CVE-2019-10629 affects Qualcomm closed‑source components in Snapdragon SoCs (e.g., Bitra, IPQ6xxx, SDM, and related devices) where a user process can pass a crafted page via an API, potentially corrupting a kernel virtual page. This is a local elevation of privilege/impact issue with high severit...

CVE-2019-13998

CVE-2019-13998 affects Qualcomm closed‑source components on Snapdragon SoCs (various Snapdragon Auto/Compute/Connectivity lines and related PCIe/telemetry stacks) with a root cause described as a lack of bounds checking on TX FIFO write/read indices read from shared RAM, enabling memory corruptio...

CVE-2020-3670

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2019-10523

CVE-2019-10523 is associated with a Qualcomm closed‑source component and is rated Moderate in the Pixel bulletin. The issue describes target-specific data being sent to a remote server, resulting in information exposure across Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables) and a lon...

CVE-2019-13992

CVE-2019-13992 describes an Out-of-bounds memory access when a stack push/pop occurs without a bound check on the stack top, affecting Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (Bitra, IPQ60xx/SA/many variants). Root cause: missing bound check on stack top leading t...

CVE-2019-14043

CVE-2019-14043 is a memory_out_of_bounds issue described as an out-of-bounds read in the Fingerprint application due to data used without length checks across Qualcomm/Snapdragon platforms (including Snapdragon Auto, Compute, Connectivity, and various Snapdragon devices). The core vulnerability i...