CVE-2018-13901

CVE-2018-13901 involves information disclosure due to missing permissions in the Android Manifest within the PCI RCS app across a wide range of Qualcomm/Snapdragon devices (Snapdragon Auto, Connectivity, IoT, Mobile, etc.). Affected components are Android apps that rely on these manifests; the ro...

CVE-2018-13911

CVE-2018-13911 affects Qualcomm Snapdragon GNSS XTRA Parser across multiple Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.). Root cause is an out-of-bounds memory read/access that may cause unexpected behavior. The vulnerability is documented with a high/critical CVSS impact by...

CVE-2018-5913

Technical details about CVE-2018-5913 are not publicly provided in the supplied documents. No affected product/version or remediation information is stated here. Monitor the sources for updates.

CVE-2018-11955

CVE-2018-11955: A missing length check on the reason-code in the payload can cause a driver to read memory outside the allocated frame, leading to an out-of-bounds read in Qualcomm/Snapdragon WLAN/driver components across Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon M...

CVE-2018-13906

CVE-2018-13906 involves a timing side-channel in the HMAC authentication of messages from QSEE on Qualcomm Snapdragon platforms, affecting a wide range of Snapdragon Auto/Compute/Connectivity/IoT/Wearables/Networking devices (many Snapdragon SoCs listed). Root cause: timing leakage allows an atta...

CVE-2018-5903

CVE-2018-5903 is an out-of-bounds read caused by improper validation of an array when processing the VDEV stop response in Qualcomm WLAN firmware (qcacld 3.0). Affected products span Qualcomm/Snapdragon platforms including Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd...

CVE-2018-13902

CVE-2018-13902 is described as an out-of-bounds memory read when decoding XTRA files in Qualcomm Snapdragon components (wide range of Snapdragon Auto/Compute/IoT/Wearables/MI devices and more listed). Root cause: improper array index validation in the decoder. Affected products include numerous S...

CVE-2018-13907

The CVE-2018-13907 entry describes a vulnerability in Qualcomm/Snapdragon components where deserializing a key blob during key operations can trigger a buffer overflow, potentially exposing partial key information across a wide range of Snapdragon devices (IPQ4019, IPQ8074, MDM9... and many SD/So...

CVE-2017-8252

CVE-2017-8252 describes a kernel-level information-disclosure vulnerability in TrustZone across Qualcomm/Snapdragon platforms (e.g., IPQ4019, QCS605, SD families). The root cause is the ability for an attacker to induce faults in TrustZone computations, leading to leakage of sensitive data from m...

CVE-2018-11939

CVE-2018-11939 affects Qualcomm-based WLAN components (e.g., Snapdragon WLAN host/MDM platforms) where a use-after-issue in WLAN functionality occurs due to multiple ACS scan requests in parallel. The NVD entry lists a Local access vector with Low attack complexity and no authentication, yielding...

CVE-2018-13908

CVE-2018-13908 affects Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity families across numerous SoCs). The issue is a truncated access authentication token that weakens access control for stored secure application data, enabling local attacker access with partial confide...

CVE-2018-13910

CVE-2018-13910 describes an out-of-bounds access in TZ caused by an invalid index used to check against DDR, affecting a wide range of Qualcomm Snapdragon SoCs (e.g., IPQ8074, MDM9xxx, MSM8xxx/SD platforms) and devices listed in the CVE. The root cause is an invalid index calculation that can lea...

CVE-2018-11976

The CVE-2018-11976 issue is described in multiple sources as an ECDSA key leakage vulnerability in Qualcomm’s secure environment. Findings indicate that private keys could be exposed from the secure world to the non-secure world via the Qualcomm Secure Execution Environment (QSEE) on Snapdragon-b...

CVE-2015-9222

CVE-2015-9222 corresponds to RomPager Misfortune Cookie authentication bypass. Affected: RomPager

CVE-2018-11271

CVE-2018-11271 is an improper authentication vulnerability affecting Qualcomm Snapdragon platforms (broad range of Snapdragon Auto/Compute/Connectivity/IoT families and related devices). The issue relates to remote command handling caused by improper event handling, enabling potential unauthorize...

CVE-2016-10439

The CVE-2016-10439 issue is a TOCTOU vulnerability in the bulletin_board_read input validation on Qualcomm Snapdragon Automotive and Mobile platforms (SD 425, 430, 450, 625, 650/52, 820, 820A) where a pointer dereference may be validated after the HLOS could modify the pointer. Affected Android r...

CVE-2015-9165

CVE-2015-9165 affects Android devices with Qualcomm Snapdragon/related SoCs (IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/212/205, SD 400/410/12/615/16/ SD 415/617/650/52/ SD 808/810) where a flaw in the QTEE file service API allows a double-free due to incorrect error handling. The vulnerability ...

CVE-2018-13886

Technical details about CVE-2018-13886 are not publicly available in the provided documents; no affected products, versions, or fixes are specified here. Monitor for updates.

CVE-2018-11953

CVE-2018-11953 describes a potential out-of-bounds access when processing the SSID IE length from a remote AP in Qualcomm WLAN/WiFi stack. Affected are Snapdragon platforms including Auto, CE Connectivity, C IoT, Industrial IoT, IoT, Mobile, Voice & Music, and Wearables (many chipsets listed: MDM...

CVE-2018-11967

CVE-2018-11967 concerns signature verification of the skel library that could be disabled because the memory region where the library is loaded is allocated from userspace in Qualcomm/Snapdragon subsystems. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial Io...

CVE-2019-2261

CVE-2019-2261 describes information disclosure caused by unauthorized access from the GPU subsystem to HLOS/non-secure memory. The vulnerability affects Qualcomm devices across multiple Snapdragon families (e.g., IPQ8074, MDM9xxx, MSM8xxx, SD-series including SD625/SD820/SD835/SD845/SD850, SDM43x...

CVE-2018-13924

The CVE-2018-13924 entry concerns a buffer length validation flaw that can take negative values, causing a stack overflow in Qualcomm components across many Snapdragon platforms (Auto/Compute/Connectivity/IOT/Industrial IOT, Mobile, Wearables, etc.) including IPQ8074 family and various SD/SM/QR s...

CVE-2019-2275

CVE-2019-2275 centers on a buffer overflow during deserialization of a key blob in Qualcomm Snapdragon firmware (multiple Snapdragon Auto/Compute/Connectivity/Secure elements). The issue arises when key operations are invoked and depends on CVE-2018-13907. Affected components include numerous Sna...

CVE-2019-2244

CVE-2019-2244 affects Qualcomm Snapdragon firmware components across a wide range of SoCs. The issue is a possible integer underflow when calculating the length of elementary stream info from an invalid section length, which is then used to read from the input buffer. Impact is described as poten...

CVE-2018-13895

CVE-2018-13895 describes an issue where missing permissions on several content providers in the RCS app’s Android manifest could enable unprivileged access on Qualcomm Snapdragon platforms (covering a broad set of Snapdragon Auto, Compute, Connectivity, IoT, Wearable, and related devices). The ro...

CVE-2017-14911

CVE-2017-14911 describes a critical elevation/remote-privilege issue in Qualcomm components where the XBL loader could skip authentication of device config on several Snapdragon platforms (IoT, Mobile, Auto, and various SD/SoCs). Public records identify the affected elements as Qualcomm closed‑so...

CVE-2018-11958

CVE-2018-11958 affects a wide range of Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Consumer/IoT/Industrial IoT, Snapdragon Mobile, Snapdragon Voice & Music) and related Media/SoC components. The root issue is insufficient protection of keypad keys, which could allow a high-security, high...

CVE-2016-10479

The CVE-2016-10479 issue affects Android devices on Qualcomm Snapdragon platforms (including MDM9607/MDM9615/MDM9635M/MDM9640 and SD 210/212/205, 400, 600, 615/16/415, 617, 650/52, 800, 810, 820) where an arbitrary length value from an incoming message to the QMI Proxy can cause an out-of-bounds ...

CVE-2018-13925

CVE-2018-13925 describes a heap-use-after-free in Qualcomm Snapdragon devices caused by an error in parsing the PMT table, where memory is freed but the context map reference is not reset. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, We...

CVE-2014-9986

CVE-2014-9986 concerns Android devices with Qualcomm components (e.g., Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear MSM8909W, SD系列) where in playready_licacq_process_response(), the length of the cbResponse is not validated and is controlled by the HLOS. If cbResponse is too large, a...

CVE-2018-11289

CVE-2018-11289 corresponds to a data truncation causing a buffer overflow in Qualcomm/ Snapdragon components (e.g., Snapdragon Auto, Compute, Connectivity, and other Snapdragon variations). The root cause is a higher-to-lower type conversion that allocates less memory than required, enabling pote...

CVE-2019-2247

CVE-2019-2247 involves a potential double-free condition triggered when running multiple smp2p tests due to missing protection for a global variable across Qualcomm Snapdragon platforms (Auto/Compute/IoT/Industrial IoT/Smart wearables and multiple SoCs). The issue affects a broad set of devices (...

CVE-2017-18329

CVE-2017-18329 describes a potential buffer overflow in RTP packet handling on Qualcomm Snapdragon automotive and wearable platforms. Affected are Snapdragon Automotive/Wear devices across listed Snapdragon/HW variants (e.g., MDM9615/9625/9635M/9640/9645/9650/9655, MSM8909W, MSM8996AU, SD 210–SD ...

CVE-2019-2248

CVE-2019-2248 describes a buffer overflow that can occur when an invalid header overwrites an existing buffer with a fixed-size allocation, affecting a wide range of Qualcomm Snapdragon products (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon IoT/Wearables, Snapdragon 615/16, 625, 820/820...

CVE-2017-18146

CVE-2017-18146 affects Android on Qualcomm Snapdragon platforms (Automobile, Mobile, Wear; various SDM/MDM/SD chips). In vulnerable builds prior to the 2018-04-05 patch level, ECDSA signature verification can fail in corner cases, potentially impacting message authentication. The issue is listed ...

CVE-2017-9711

CVE-2017-9711 concerns Qualcomm IPA: the vulnerability description across sources states that certain unprivileged processes can perform IOCTL calls, implying local access required and potential privilege-related impact within affected Qualcomm components. Connected documents identify Qualcomm IP...

CVE-2015-9198

Summary of CVE-2015-9198 : An integer underflow in the Qualcomm qsee_register_log_buff function allows writing beyond intended bounds, potentially corrupting secure memory. The public records identify affected Android builds on Qualcomm-based devices (e.g., Snapdragon Automobile, Snapdragon Mobil...

CVE-2017-18324

Cryptographic key material leakage in debug messages affecting GERAN on Snapdragon mobile/wear (various MDM/SD/SM/SDX devices). Root cause: leakage of keys in debug output for affected Qualcomm components; CVE-2017-18324. Consequences: information disclosure with partial confidentiality impact as...

CVE-2015-9128

CVE-2015-9128 describes a buffer overread caused by lack of validation of the buffer size in Android on Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) across multiple SD/x variants. The issue affects devices with Android before the 2018-04-05 security patch level and is addressed by the...

CVE-2018-11820

CVE-2018-11820 concerns a side-channel leak caused by using a non-time-constant memcmp function in Qualcomm/Snapdragon components. Affected platforms include Snapdragon Auto/Compute/Connectivity, Snapdragon IoT lines and many SDM/SD/SDM variants (e.g., IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640,...

CVE-2019-2290

CVE-2019-2290 affects the Qualcomm camera stack across Snapdragon devices. The root cause is a race condition where multiple threads opening/closing the camera driver can cause access to a destroyed session data pointer, potentially impacting camera operation. Documents from NVD and Red Hat descr...

CVE-2017-11004

CVE-2017-11004 affects Qualcomm Snapdragon components across multiple platforms (e.g., IPQ8074, MDM9xxx, MSM8996AU and a wide range of SD-series chipsets) where a non-secure user can access certain registers in Snapdragon Automotive, Mobile and Wear devices. The impact is local with partial confi...

CVE-2017-14913

CVE-2017-14913 concerns a Qualcomm-closed source component vulnerability in Android prior to the 2018-01-05 patch level. The issue involves DDR address input validation that is allegedly truncated, potentially enabling remote impact over the network with no user interaction. The CVE is listed und...

CVE-2017-18139

CVE-2017-18139 describes a buffer overflow vulnerability in Android prior to the 2018-04-05 patch level affecting Qualcomm Snapdragon mobile/wear platforms (e.g., MDM9206/9607/9635M/9640/9645/9650/9655, MSM8909W, SD series). The flaw could exist during IMS call setup, potentially enabling an expl...

CVE-2018-11849

The CVE-2018-11849 entry describes a buffer overflow caused by a missing bounds check on the out-of-range bssid parameter during scan start processing in Qualcomm Snapdragon wireless code. Affected devices/SoCs include Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear platforms across num...

CVE-2018-11938

CVE-2018-11938 affects Qualcomm/Snapdragon components (e.g., IPQ8074, MSM89xx, SDx series, etc.) via improper input validation of an HLOS argument, causing potential buffer overflows and unexpected behavior. Root cause is input validation failure in the argument path from HLOS; impact could invol...

CVE-2018-5852

CVE-2018-5852 describes an unsigned integer underflow in the Qualcomm IPA driver that results in a buffer over-read when reading NAT entries via the debugfs path /sys/kernel/debug/ipa/ip4_nat. The vulnerability is tied to the IPA driver component and affects Qualcomm chipsets; the underlying issu...

CVE-2014-10052

The CVE-2014-10052 issue affects Android on Qualcomm TZ subsystem usage (TZ apps and PIL image subsystem) where reserved memory is not cleared after use. Affected platforms include Android builds before 2018-04-05 patch level across numerous Snapdragon Mobile, Wear, and related SoCs (e.g., FSM905...

CVE-2015-9109

The CVE-2015-9109 issue concerns Android devices using Qualcomm Snapdragon Automotive and Snapdragon Mobile MDM9625, SD 425/430/450/625/650/52/820/820A. The root cause is lack of address-argument validation in the inqsee_fuse_write path, which could lead to an untrusted pointer dereference. Conne...

CVE-2017-11088

CVE-2017-11088 is an SQL injection vulnerability described as a result of improper input validation in the Linux io-prefetch component on Qualcomm/Qualcomm-derived platforms. Public entries indicate affected Qualcomm/SoC families include MSM8909W, MSM8996AU and various Snapdragon SoCs (SD 210/212...