CVE-2019-2239

CVE-2019-2239 is a Qualcomm/Snapdragon-related issue where sanity checks are missing in layout, potentially causing SUI corruption or denial of service. Affected families span Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (e.g., MDM9150, SD 210/212/205, SD 410/12, SD 62...

CVE-2019-2324

CVE-2019-2324 affects Qualcomm Snapdragon devices where ADSP can be compromised, causing the audio port index returned by ADSP to be out of bounds and trigger out-of-bound access across a wide range of Snapdragon products (Auto, Connectivity, IoT, Wearables, and other SKUs). Root cause is an inte...

CVE-2019-2328

CVE-2019-2328 describes a potential buffer overflow when the number of channels exceeds the size of the channel mapping array in Qualcomm/ Snapdragon audio-related components (across multiple Snapdragon families). The vulnerability is listed under Qualcomm Audio in the 2019 Android security conte...

CVE-2019-2341

CVE-2019-2341 describes a buffer overflow in the audio subsystem when a user-provided audio buffer size exceeds the maximum allowed. Affected: Snapdragon SoCs and families listed in the entry (e.g., Snapdragon Auto/Compute/IoT, Snapdragon Mobile, Wearables, etc.). Root cause: unchecked size in au...

CVE-2014-10048

CVE-2014-10048 affects Android on Qualcomm Snapdragon mobile/wear platforms (numerous SKUs) prior to the 2018-04-05 security patch level. The issue arises in time-services when setting offsets, where bases can be configured to values greater than the valid base, causing an array index out-of-boun...

CVE-2014-9989

CVE-2014-9989 affects Android devices with Qualcomm Snapdragon Mobile and Snapdragon Wear (e.g., MDM9206/9607/9615/9625/9635M, MSM8909W, SD 210/212/205, SD 400/410/12, SD 425/430/600/615/16/SD 415/625/650/52/808/810/450, etc.). The vulnerability is in the USB management module and is triggered by...

CVE-2015-9157

CVE-2015-9157 describes a race-condition in Android Qualcomm widevine support where rsp buffers passed to widevine commands in widevine_dash_cmd_handler() can be read or overflowed due to memory not being locked during time-of-check/time-of-use. Affected are Android devices with Qualcomm Snapdrag...

CVE-2015-9172

The CVE-2015-9172 issue affects Android platforms with WideVine API on Qualcomm Snapdragon families (Automotive, Mobile, Wear) including devices using SD 210/212/205, 400, 410/12, 425, 430, 450, 615/16/415, 617, 625, 650/52, 800, 808, 810, 820/820A, 835, 845, 850. In a WideVine API function, a bu...

CVE-2015-9177

CVE-2015-9177 describes a buffer over-read in a crypto API function on Android devices using Qualcomm Snapdragon (broad range of Automotive/Mobile/Wearable SD family) prior to the 2018-04-05 patch level. The issue is rated high/critical, with CVSSv3.0 vectors indicating network access, no user in...

CVE-2016-10457

CVE-2016-10457 affects Android on Qualcomm Snapdragon-based devices (multiple SoCs listed) where an app requests more permissions than required. The issue is described as a permission overreach with a high-impact risk profile (CVSS v3: 9.8, Network, No user interaction) and is documented for Andr...

CVE-2016-10462

CVE-2016-10462 affects Android platforms with Qualcomm SoCs where HLOS Access Control policy could allow access to Slimbus, GPU, and GIC resources due to insufficient isolation in certain Snapdragon generations (e.g., SD 410/12, 425, 427, 430, 435, 450, 615/16/SD 415, 625, 650/52, 808, 810, 820/8...

CVE-2016-10472

CVE-2016-10472 affects Qualcomm Snapdragon mobile and wearable SoCs (e.g., MDM9206/9607/9650, MSM8909W, SD 210/212/205, 400, 410/12, 425, 430, 450, 600, 615/16/415, 617, 625, 650/52, 800, 808, 810, 820, 835, SDX20). Root cause: HLOS kernel failed to check address and size passed to TZ_INFO_GET_SE...

CVE-2016-10492

CVE-2016-10492 affects Android devices running on Qualcomm Snapdragon/mobile platforms. The issue arises from improper ciphersuite validation, allowing SecSSL to accept an unadvertised ciphersuite. Reported impact includes high confidentiality and integrity concerns (per CVSSv3: Critical, 9.1; CV...

CVE-2017-18330

CVE-2017-18330 describes a buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in Qualcomm Snapdragon-based platforms (automotive, mobile, wearables) across numerous SoCs and SD/SoC families. The issue affects components implementing AES-CCM/GCM and can impact confidential...

CVE-2018-13897

CVE-2018-13897 affects Snapdragon devices running dnsmasq, where a hostname is added to the device’s DNS records, causing information exposure (confidentiality impact). Affected families include Snapdragon Auto, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Wearables across numerous SD...

CVE-2018-5918

CVE-2018-5918 describes a possible buffer overflow in the DRM Trusted application on Qualcomm Snapdragon platforms (e.g., MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD family up to SDX24 and SXR1130, including SD410/12, SD425, SD430, SD450, SD615/16/SD415, SD625, SD650/52, SD800, SD810, SD82...

CVE-2019-2253

CVE-2019-2253 is a buffer over-read that can occur when parsing a corrupted OGG comment block in Qualcomm Snapdragon devices (listed families). The root cause is parsing a stream with malformed metadata leading to reading beyond bounds. The description and connected documents do not provide expli...

CVE-2019-2272

CVE-2019-2272 is a buffer overflow in the display function caused by insufficient validation of the header block size in Qualcomm Snapdragon devices (including Snapdragon Auto/IoT/Mobile/Wearables families such as SD 210–SD 212/SD 205, 425, 427, 430, 435, 450, 615/16/415, 625, 636, 650/52, 712/71...

CVE-2014-9993

CVE-2014-9993 is a buffer overread vulnerability affecting Android on Qualcomm Snapdragon platforms (including automotive/mobile/wear MDMs and Snapdragon SD/SoC families) that may occur when provisioning content with a large message. The available sources describe the issue as a large-message pro...

CVE-2015-9203

CVE-2015-9203 describes a buffer overread caused by missing input validation in playready_set_domainid on a wide range of Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) and various Snapdragon SoCs. This affects Android versions up to the 2018-04-05 security patch level; the issue is doc...

CVE-2015-9206

Technical details about CVE-2015-9206 are not publicly provided in the connected documents. The materials available here reiterate the issue description but do not specify affected products, root cause, impact, or remediation. Monitor for updates.

CVE-2015-9211

CVE-2015-9211 describes a buffer overread in the PlayReady module affecting Android devices with Qualcomm Snapdragon ranges (Automobile, Mobile, Wear) prior to the 2018-04-05 patch level. The issue occurs when a large PlayReady message is processed, potentially impacting confidentiality, integrit...

CVE-2017-18126

CVE-2017-18126 affects Android on Qualcomm-based devices (e.g., Snapdragon/WLAN stacks) where the original mac spoofing feature in probe requests for cfg80211 scan, vendor scan, and pno scan did not use randomized sequence numbers or randomized source addresses. This privacy-related flaw could af...

CVE-2017-18320

CVE-2017-18320 describes a data abort in QSEE when unloading on a third-party TEE without prior loading, affecting Qualcomm Snapdragon automotive/mobile platforms across numerous SoCs (e.g., MSM8996AU, SD 410/12, 820, 835, 650/52, 710/670, 810, 820A, 835, 660, several SDM/SXR variants). The linke...

CVE-2018-11921

The CVE-2018-11921 entry concerns a failure-condition handling defect that fails to return the correct error code. Affects Snapdragon family components across numerous SoCs (e.g., MDM9206, MDM9607, MDM9650, MSM8996AU, SD/SDX-series, SDA-series, SXR1130) and can cause unintended SUI behavior or di...

CVE-2018-13913

CVE-2018-13913 describes an unauthorized access vulnerability caused by improper validation of an array index while processing debugFS in Qualcomm Snapdragon components. The CNVD entry (CNVD-2019-05662) specifies this vulnerability as affecting multiple Qualcomm products and variants, including M...

CVE-2018-5838

CVE-2018-5838 concerns an “Improper Validation of Array Index” in the Adreno OpenGL driver affecting Snapdragon platforms (Automobile, Mobile, Wear). The issue can lead to an out-of-bounds access in SurfaceFlinger . According to the NVD entry, it has a CVSS v3.0 base score of 7.8 (High) , with LO...

CVE-2018-5874

The CVE-2018-5874 issue is a stack-based buffer overflow occurring in the MP4 parser of Qualcomm Snapdragon components: Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. The root cause is a parsing-time overflow in the MP4 handling, with the impact described as potential arbitrary cod...

CVE-2019-10508

CVE-2019-10508 describes a vulnerability due to lack of input validation for data received from user space, which can cause out-of-bounds access in WLAN on Snapdragon devices. Affected families include Snapdragon Auto, Snapdragon Connectivity, Snapdragon IOT, Snapdragon Mobile, and others listed ...

CVE-2019-2325

CVE-2019-2325 affects a wide range of Qualcomm Snapdragon components (Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/IoT/Mobile/Voice & Music/Wearables) across multiple platforms (MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, and various SD/SDM/SDA/SDX ser...

CVE-2014-9991

CVE-2014-9991 describes a buffer overflow in Qualcomm closed-source Android components when USB mass storage transfers exceed 16kB. Public sources (CNVD-2018-08826, NVD entry) tie this issue to Android devices using Qualcomm Snapdragon/mobile platforms (e.g., MDM9206/9625/9635M/etc., SD series) a...

CVE-2015-9132

CVE-2015-9132: In Android on Qualcomm Snapdragon mobile/Small Cell SoCs (FSM9055 and SD variants listed) prior to the 2018-04-05 patch level, there is an arbitrary memory read due to an untrusted pointer dereference when handling HLOS-controlled values passed to the QSEE syscall helper. Affected ...

CVE-2015-9142

CVE-2015-9142 describes a bounds-check omission for a vtable index in the DAL-TO-QDI conversion framework affecting multiple Qualcomm/Snapdragon mobile platforms (Android before 2018-04-05 SPL or earlier patch level). Affected products include a broad set of Snapdragon/SDM devices listed in the d...

CVE-2015-9160

CVE-2015-9160 affects Qualcomm‑based Android devices (Snapdragon) prior to 2018-04-05 SPLs, where an integer overflow may occur in TZBSP_GFX_DCVS_UPDATE_ID when HLOS graphics driver busy time and total time values are very large. The issue is documented in NVD with a CVSS v3.0 base score of 9.8 (...

CVE-2015-9181

CVE-2015-9181 is a buffer over-read in a crypto API function affecting multiple Qualcomm Snapdragon platforms (Automobile, Mobile, Wear; SD 210/212/205, 400, 410/12, 425, 430, 450, 615/16/ SD 415, 617, 625, 650/52, 800, 808, 810, 820/820A, 835). Root cause is a memory over-read in the crypto API ...

CVE-2015-9186

CVE-2015-9186 affects Android on Qualcomm Snapdragon family (automobile, mobile, wearables) and several SoCs (e.g., SD 210/212/205, 400/410, 425/430/450, 615/625/650/52, 800/808/810/820/835/845, 850) where a buffer over-read can occur in a PlayReady API function. The issue is documented with a hi...

CVE-2015-9195

CVE-2015-9195 affects Android (pre-2018-04-05 patch level) on Qualcomm Snapdragon platforms (MDM9625/9635M/9650/9655; SD 400/410–12/615/16/415/617/650/52/808/810; SDX20) where a QTEE syscall handler can trigger a buffer overflow in the High-Level OS (HLOS). The issue is rooted in the QTEE syscall...

CVE-2016-10417

The CVE-2016-10417 entry describes a TOCTOU vulnerability in QTEE across numerous Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) including IPQ4019, MDM9xxx, SD-series chips. The issue arises from improper access control, enabling timing-based races that could compromise confidentiality,...

CVE-2016-10452

CVE-2016-10452 affectsAndroid environments on Qualcomm Snapdragon Automotive and Snapdragon Mobile (SD 410/12, 425, 430, 450, 615/16/415, 617, 625, 650/52, 808, 810, 820, 820A, 835). Root cause: memory protection assertion occurs after out-of-order termination of a trusted application (TA). Impac...

CVE-2016-10498

CVE-2016-10498 affects Android devices with Qualcomm Snapdragon platforms (e.g., MDM9635M/9645/9650/9655, SD 210–650 series, SDM630/636/660, Snapdragon_High_Med_2016). The issue arises when stopping of the DTR occurs prematurely, which can cause the micro kernel to become stuck; the trigger is a ...

CVE-2017-17773

CVE-2017-17773 affects Qualcomm closed‑source components used in Snapdragon Automotive/Wearable and various Snapdragon mobile platforms (e.g., MDM9206/9607/9650 and many SD/MSM variants). The vulnerability stems from improper input validation in the function video_fmt_mp4r_process_atom_avc1(), wh...

CVE-2017-18072

CVE-2017-18072 affects Android on Qualcomm Snapdragon/mobile platforms (list of affected SoCs) where probe requests from a user’s device reveal information elements that specify supported Wi‑Fi features, creating a potential privacy risk if sniffed. The root cause is the disclosure of Wi‑Fi infor...

CVE-2017-18130

CVE-2017-18130 is a buffer over-read vulnerability in Android media handling (ASF playback) affecting Qualcomm Snapdragon Mobile/Automobile/Wear platforms and a range of Snapdragon SoCs. Root cause: potential over-read during ASF file processing could lead to arbitrary code execution or crashes w...

CVE-2017-18145

CVE-2017-18145 describes a Use-After-Free condition in the DPM native process while handling Android framework events on Qualcomm Snapdragon platforms. The underlying issue is that an iterator pointer is deleted after an event is processed, which can cause a Use After Condition during processing ...

CVE-2017-18279

CVE-2017-18279 involves a buffer length check omission that can cause a buffer overflow in the camera module across a range of Qualcomm/Snapdragon platforms (Small Cell SoC, Snapdragon Mobile/Wear and related SoCs such as FSM9055/ FSM9955, IPQ4019/8064, MDM/multiple, QCA/SD series). The provided ...

CVE-2017-18319

CVE-2017-18319 corresponds to an information disclosure in the UIM API debug messages affecting Snapdragon/mobile devices listed (MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415,...

CVE-2017-18323

CVE-2017-18323 involves cryptographic key material leakage in TDSCDMA RRC debug messages affecting Qualcomm Snapdragon components across multiple platforms (e.g., MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU) and various SD/SoC families (e.g., SD 21...

CVE-2018-11279

CVE-2018-11279 describes a buffer overflow caused by lack of input size checking in Qualcomm Snapdragon components for automotive, mobile, and wearables. Affected families include a long list of Qualcomm/SDM/SD variations (e.g., MDM9206, MDM9607, SD 210/212/205, SD 410/12, SD 625, SD 835, SD 845/...

CVE-2018-11931

CVE-2018-11931 is listed in the Qualcomm closed-source components section of the 2019 Android security bulletin. The vulnerability is described as improper access to HLOS when transferring memory to CPZ in multiple Snapdragon/SOC families (e.g., MDM/SD series and Snapdragon channels). The CVSS da...

CVE-2018-5869

CVE-2018-5869 concerns improper input validation in the QTEE keymaster app, leading to invalid memory access on Qualcomm Snapdragon mobile/wear platforms. Affected are devices using several Snapdragon families (e.g., MDM9206, MDM9607, MSM8909W, SD 210/212/205, SD 410/12, SD 615/16/SD 415, SD 800,...