CVE-2017-17773

CVE-2017-17773 affects Qualcomm closed‑source components used in Snapdragon Automotive/Wearable and various Snapdragon mobile platforms (e.g., MDM9206/9607/9650 and many SD/MSM variants). The vulnerability stems from improper input validation in the function video_fmt_mp4r_process_atom_avc1(), wh...

CVE-2017-18072

CVE-2017-18072 affects Android on Qualcomm Snapdragon/mobile platforms (list of affected SoCs) where probe requests from a user’s device reveal information elements that specify supported Wi‑Fi features, creating a potential privacy risk if sniffed. The root cause is the disclosure of Wi‑Fi infor...

CVE-2017-18130

CVE-2017-18130 is a buffer over-read vulnerability in Android media handling (ASF playback) affecting Qualcomm Snapdragon Mobile/Automobile/Wear platforms and a range of Snapdragon SoCs. Root cause: potential over-read during ASF file processing could lead to arbitrary code execution or crashes w...

CVE-2017-18145

CVE-2017-18145 describes a Use-After-Free condition in the DPM native process while handling Android framework events on Qualcomm Snapdragon platforms. The underlying issue is that an iterator pointer is deleted after an event is processed, which can cause a Use After Condition during processing ...

CVE-2017-18279

CVE-2017-18279 involves a buffer length check omission that can cause a buffer overflow in the camera module across a range of Qualcomm/Snapdragon platforms (Small Cell SoC, Snapdragon Mobile/Wear and related SoCs such as FSM9055/ FSM9955, IPQ4019/8064, MDM/multiple, QCA/SD series). The provided ...

CVE-2017-18319

CVE-2017-18319 corresponds to an information disclosure in the UIM API debug messages affecting Snapdragon/mobile devices listed (MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415,...

CVE-2017-18323

CVE-2017-18323 involves cryptographic key material leakage in TDSCDMA RRC debug messages affecting Qualcomm Snapdragon components across multiple platforms (e.g., MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU) and various SD/SoC families (e.g., SD 21...

CVE-2018-5869

CVE-2018-5869 concerns improper input validation in the QTEE keymaster app, leading to invalid memory access on Qualcomm Snapdragon mobile/wear platforms. Affected are devices using several Snapdragon families (e.g., MDM9206, MDM9607, MSM8909W, SD 210/212/205, SD 410/12, SD 615/16/SD 415, SD 800,...

CVE-2019-10498

CVE-2019-10498 describes a buffer overflow in a Qualcomm closed‑source component triggered when a client sends more than 5 io_vec requests to the server. Affected products span Snapdragon Auto/Compute, Snapdragon IoT devices, and related Snapdragon/SDM families (e.g., SD 210–855, various Snapdrag...

CVE-2019-10505

CVE-2019-10505 describes an out-of-bounds access issue when processing a non-standard IE measurement request whose length crosses the frame boundary in Qualcomm Snapdragon platforms. Affected are a wide range of Snapdragon devices and families, including Snapdragon Auto, Snapdragon Consumer Elect...

CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...

CVE-2015-9161

CVE-2015-9161 describes a TOCTOU-induced buffer overflow in playready_reader_bind() affecting Android on Qualcomm Snapdragon platforms (MSM8909W; SD 210/212/205; SD 400; SD 410/12; SD 615/16/SD 415; SD 617; SD 650/52; SD 800; SD 808; SD 810). Affected Android versions are before the 2018-04-05 se...

CVE-2015-9171

CVE-2015-9171 describes a buffer over-read in OEMCrypto_Dash_InstallEncapKeybox() when keyBoxLength exceeds TZ_WV_MAX_DATA_LEN (20k) on various Qualcomm/Android components. Affected: Android devices with Qualcomm Snapdragon Automotive/Mobile/Wear stack listed in the description (multiple SoCs). R...

CVE-2015-9189

The CVE-2015-9189 issue affects Android devices with Qualcomm Snapdragon SoCs (e.g., IPQ4019, MDM9xxx, SD 210/212/205, SD 400/410/12, SD 600/615/16/SD 415, SD 808, SD 810) prior to the 2018-04-05 patch level. The root cause is a vulnerability in the TZ application command handling (tz_app_cmd_han...

CVE-2015-9209

CVE-2015-9209 targets Android devices with Qualcomm Snapdragon/mdm platforms, where there is improper access control in a file storage API. The issue affects a wide range of Qualcomm/SDP SKUs (e.g., MDM9xxx, MSM89xx, SD 210–850, SDX20) and is described in the Android vulnerability bulletin as req...

CVE-2016-10407

CVE-2016-10407 affects Android platforms prior to the 2018-04-05 patch level, involving an integer overflow that can trigger a buffer overflow during a VT call on Qualcomm Snapdragon Mobile SoCs (SD 210/212/205, 400, 410/12, 430, 450, 615/16/ SD 415, 617, 625, 650/52, 800, 808, 810, 820, 835). Af...

CVE-2016-10436

CVE-2016-10436 affects Android on Qualcomm/Qualcomm-based SoCs (e.g., Qualcomm Small Cell SoC, Snapdragon Mobile and Wear FSM9055; IPQ4019/IPQ8064/MDM92xx/MSM89xx/SD family and related SDX20 devices). The issue is improper input validation on a read path that leads to memory corruption in the aff...

CVE-2016-10449

CVE-2016-10449 affects Android on Qualcomm Snapdragon devices (GNSS API) where, prior to the 2018-04-05 patch level, a NULL pointer dereference in GNSS API functions could occur. The issue is associated with Snapdragon Mobile and Wear platforms (e.g., MDM9206/9607/9640/9650, MSM8909W, SD 210–835 ...

CVE-2016-10451

CVE-2016-10451 affects Android devices with Qualcomm-based Snapdragon Mobile and Snapdragon Wear platforms (various SDM/MDM/SD series listed in the description). The issue is privilege escalation caused by inherently insecure handling of local files, exploitable on devices prior to the 2018-04-05...

CVE-2016-10467

Technical details about CVE-2016-10467 are not publicly available in the provided connected documents. Please monitor for updates from official advisories.

CVE-2016-10476

CVE-2016-10476 affects Android on Qualcomm Snapdragon/mobile platforms (e.g., MSM/SD family). The issue is missing array index checks on the app index in function qcril_uim_clear_encrypted_pin, causing out-of-bounds reads when the app index is too large. Documented in multiple sources as a vulner...

CVE-2016-10491

CVE-2016-10491 is an Android vulnerability affecting devices with Qualcomm Snapdragon Mobile and related SoCs. The issue arises from an integer overflow that can overflow a buffer in a QuRT API function, potentially enabling further impact on affected devices. Public references describe impact ac...

CVE-2017-18326

CVE-2017-18326 affects Qualcomm Snapdragon mobile and Snapdragon Wear modem components (e.g., MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 800, ...

CVE-2018-11888

CVE-2018-11888 targets Qualcomm Snapdragon platforms, where the SCP11 Crypto Services Trust Application can be commanded by other TAs. Affects numerous Snapdragon SoCs (e.g., SD 210/212/205 through SD 835, 820/820A, 650/52, 625, 615/16, and others) across MDM9607/9650/9655, MSM8996AU, and related...

CVE-2019-10488

CVE-2019-10488 describes a Null pointer dereference in the Qualcomm Snapdragon media parsing when handling nonstandard clips; the issue affects a broad range of Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.) across many SD/SoC families listed in the description. Root cause is ...

CVE-2019-2254

CVE-2019-2254 affects Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/IoT/Mobile lines, including various SD/SDM/RH-series) where position-determination accuracy can be degraded due to wrongly decoded information. The root cause is not explicitly detailed beyond the decoding error...

CVE-2019-2331

CVE-2019-2331 describes a possible integer overflow caused by subtracting two integers without overflow checks in Qualcomm/Xiaomi Snapdragon family devices (e.g., Snapdragon Auto/Compute/IoT/Mobile and related SSDs listed in the description). The issue affects a broad set of Qualcomm/Snapdragon c...

CVE-2014-10053

CVE-2014-10053 relates to a Widevine-related data access validation issue in Android on Qualcomm Snapdragon platforms (automotive, mobile, wearables) prior to the 2018-04-05 security patch level. The description specifies that data access was not properly validated within the Widevine secure appl...

CVE-2014-10062

The CVE-2014-10062 issue concerns Android on Qualcomm Snapdragon mobile/wear devices where LocationService is exported, enabling other services to import and call its methods to bring up a data connection. This could allow a nearby or malicious service to trigger data-connection initiation if it ...

CVE-2015-9124

CVE-2015-9124 affects Android devices with Qualcomm Snapdragon SoCs (MDM9625/9635M/9640/9645 and SD families 210/212/205, 400, 410/12, 615/16/415, 800, 808, 810). The issue can cause a crash or expose otherwise inaccessible memory contents when accessing an invalid pointer. The Android bulletin c...

CVE-2015-9130

CVE-2015-9130 describes a NULL pointer dereference in a PlayReady function on Android running on Qualcomm Snapdragon Mobile and Snapdragon Wear (e.g., MSM8909W; SD 210/212/205; 400; 410/12; 615/16/SD 415; 617; 650/52; 808; 810) prior to the 2018-04-05 security patch level. The issue is exploitabl...

CVE-2015-9166

CVE-2015-9166 concerns DRM provisioning in QSEE-based components on Qualcomm Snapdragon platforms. The issue arises because the finalize_prov_flag.data mechanism, intended to prevent further provisioning after initial provisioning, is not sufficiently checked, allowing provisioning to proceed eve...

CVE-2015-9169

CVE-2015-9169 describes a buffer over-read in the QSEE app on Android devices with Qualcomm Snapdragon Mobil/Wear platforms (various SD generations listed). The issue could lead to leakage of confidential information. The entry is publicly cataloged in NVD and CVE records, and is addressed by And...

CVE-2015-9170

CVE-2015-9170: In Android devices with Qualcomm Snapdragon components (Automobile, Mobile, Wear; including MDM9206/9650, MSM8909W, SD 210–212/205, SD 400/410/12, SD 425/430/450, SD 615/16/415, SD 617/625/650/52, SD 800/808/810/820/820A, SD 835/845/850), an incorrect offset check in wv_dash_core_r...

CVE-2015-9182

Technical details about CVE-2015-9182 (affected Qualcomm Android components, exact versions, exploit conditions) are not publicly provided in the connected documents. Monitor for updates from NVD/Android bulletins for concrete impact and remediation.

CVE-2015-9185

Technical details such as affected products, component, root cause, impact, and fixes are not publicly provided in the supplied documents; monitor for updates.

CVE-2015-9205

In CVE-2015-9205, a buffer over-read can occur in a PlayReady API function on Android devices with Qualcomm SD series (MSM8909W, SD210/SD212/SD205, SD410/12, SD615/16/SD415, SD808, SD810). The issue affects Android before 2018-04-05 or earlier patch levels; CVSS indicates a critical impact (high ...

CVE-2015-9213

CVE-2015-9213 affects Android devices with Qualcomm Snapdragon/mobile platforms. The issue arises from the DIAG-EFS EFS2_DIAG_DELTREE command, handled by fs_diag_deltree_handler(), which is documented to delete files and directories only inside the /public folder. According to NVD, the vulnerabil...

CVE-2016-10406

CVE-2016-10406 affects Qualcomm-based Android devices (notably Snapdragon SoCs including MDM9650 and a wide range of SD 210/212/205, 410/12, 430, 450, 615/16/415, 617, 625, 650/52, 808, 810, 820, 835) where printing a pointer in wlan_qmi_err_cb prints the real kernel address regardless of kptr_re...

CVE-2016-10412

CVE-2016-10412 describes an integer overflow that could lead to a buffer overflow in a memory API function on Android devices with Qualcomm Small Cell SoCs, Snapdragon Mobile, and Snapdragon Wear families. The affected range includes numerous Snapdragon/SD and related components, with the issue a...

CVE-2016-10435

CVE-2016-10435 is a TOCTOU vulnerability in some Qualcomm QTEE syscall handlers affecting Android versions prior to the 2018-04-05 security patch level (and prior to patches included in the 2018-04-01/05 Android bulletins). The issue is documented as enabling potential compromises in confidential...

CVE-2016-10445

CVE-2016-10445 describes improper input validation in a Qualcomm QTEE API function affecting Android devices with Snapdragon Automotive and Snapdragon Mobile platforms (SD 410/12, 425, 427, 430, 435, 450, 615/16/SD 415, 625, 820, 820A, 835, 845, 850, SDM630/636/660, Snapdragon_High_Med_2016). The...

CVE-2016-10456

CVE-2016-10456 affects Android on Qualcomm Snapdragon Mobile and Snapdragon Wear platforms (numerous SoCs listed in the description). The issue arises when the radish component is run with an invalid network interface name, allowing an arbitrary command of up to 15 characters to be executed as a ...

CVE-2016-10469

CVE-2016-10469: In Android (pre-2018-04-05 SPL) on Qualcomm Snapdragon platforms, RSA padding functions in CORE were incorrectly implemented, enabling information exposure. Affected: Android devices with Qualcomm Snapdragon Automotive/mobile/wear SoCs listed; impact described as High for confiden...

CVE-2017-18140

CVE-2017-18140 affects Android on Qualcomm Snapdragon Automotive/Mobile/Wear platforms. The issue occurs when processing a call disconnection; an attempt to print the RIL token-id to the debug log can lead to a Use After Free condition if eMBMS is enabled, potentially enabling a network-initiated...

CVE-2017-18294

CVE-2017-18294 describes a buffer overread when reading the ELF header file class type on Qualcomm closed‑source components (e.g., SoCs in Snapdragon/SD lines). The root cause is a size check mismatch where the ELF file size is less than the ELF64 header, potentially enabling local code execution...

CVE-2017-18303

CVE-2017-18303 describes a buffer overflow in Qualcomm Snapdragon components (including Snapdragon Automobile, Mobile, and Wear families across listed SD/x chips) caused by unvalidated inputs while processing the sensors registry configuration file. The root cause is input validation failure lead...

CVE-2018-11258

CVE-2018-11258 is a Use-After-Free vulnerability in the ADSP RPC component affecting Snapdragon devices (including Snapdragon Automotive, Mobile, and Wear platforms) with affected generations such as MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, and various SDx and SoCs (e.g., SD 210/212/205, 4...

CVE-2018-5885

CVE-2018-5885 affects Snapdragon Mobile and Snapdragon Wear. The issue is a buffer overflow during dynamic font loading when the number of font segments is out of range in the font file, impacting the font loader component. The NVD metrics list a NETWORK, LOW-attack complexity, NONE authenticatio...

CVE-2014-9990

CVE-2014-9990 pertains to Android devices using Qualcomm Snapdragon platforms (e.g., MDM92xx, MSM89xx, SD 210/212/205, 410/12, 425, 430, 600, 615/16/415, 625, 650/52, 808, 810, 450, etc.). Description: lack of input validation could cause an out-of-bounds array access. The involved advisories ind...