CVE-2018-13901

CVE-2018-13901 involves information disclosure due to missing permissions in the Android Manifest within the PCI RCS app across a wide range of Qualcomm/Snapdragon devices (Snapdragon Auto, Connectivity, IoT, Mobile, etc.). Affected components are Android apps that rely on these manifests; the ro...

CVE-2019-2256

The CVE-2019-2256 entry concerns a vulnerability in Qualcomm closed‑source components affecting Snapdragon devices (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon Mobile, Wearables, IOT, and related variants listed in the Red Hat/Qualcomm advisories). An unprivileged user can craft a bits...

CVE-2018-13911

CVE-2018-13911 affects Qualcomm Snapdragon GNSS XTRA Parser across multiple Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.). Root cause is an out-of-bounds memory read/access that may cause unexpected behavior. The vulnerability is documented with a high/critical CVSS impact by...

CVE-2018-5913

Technical details about CVE-2018-5913 are not publicly provided in the supplied documents. No affected product/version or remediation information is stated here. Monitor the sources for updates.

CVE-2018-3583

The CVE-2018-3583 issue affects Qualcomm Snapdragon lines (e.g., Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables) including MDM9206/MDM9607/MDM9640/MDM9650, MSM8909W, MSM8996AU, QCA9379, QCS...

CVE-2018-13906

CVE-2018-13906 involves a timing side-channel in the HMAC authentication of messages from QSEE on Qualcomm Snapdragon platforms, affecting a wide range of Snapdragon Auto/Compute/Connectivity/IoT/Wearables/Networking devices (many Snapdragon SoCs listed). Root cause: timing leakage allows an atta...

CVE-2018-11955

CVE-2018-11955: A missing length check on the reason-code in the payload can cause a driver to read memory outside the allocated frame, leading to an out-of-bounds read in Qualcomm/Snapdragon WLAN/driver components across Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon M...

CVE-2019-2259

CVE-2019-2259 refers to a resource allocation error that occurs when playing a video whose dimensions exceed the supported limit on Qualcomm Snapdragon platforms (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, etc.). Affected family spans numerous Snapdrag...

CVE-2018-13902

CVE-2018-13902 is described as an out-of-bounds memory read when decoding XTRA files in Qualcomm Snapdragon components (wide range of Snapdragon Auto/Compute/IoT/Wearables/MI devices and more listed). Root cause: improper array index validation in the decoder. Affected products include numerous S...

CVE-2018-13907

The CVE-2018-13907 entry describes a vulnerability in Qualcomm/Snapdragon components where deserializing a key blob during key operations can trigger a buffer overflow, potentially exposing partial key information across a wide range of Snapdragon devices (IPQ4019, IPQ8074, MDM9... and many SD/So...

CVE-2017-8252

CVE-2017-8252 describes a kernel-level information-disclosure vulnerability in TrustZone across Qualcomm/Snapdragon platforms (e.g., IPQ4019, QCS605, SD families). The root cause is the ability for an attacker to induce faults in TrustZone computations, leading to leakage of sensitive data from m...

CVE-2018-11939

CVE-2018-11939 affects Qualcomm-based WLAN components (e.g., Snapdragon WLAN host/MDM platforms) where a use-after-issue in WLAN functionality occurs due to multiple ACS scan requests in parallel. The NVD entry lists a Local access vector with Low attack complexity and no authentication, yielding...

CVE-2018-13919

CVE-2018-13919 is a use-after-free vulnerability that can occur when resetting the routing table if an invalid rule id is encountered during the reset command. Affected devices span Qualcomm Snapdragon platforms including Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon C...

CVE-2018-13908

CVE-2018-13908 affects Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity families across numerous SoCs). The issue is a truncated access authentication token that weakens access control for stored secure application data, enabling local attacker access with partial confide...

CVE-2019-2257

CVE-2019-2257 involves wrong permissions in a configuration file, enabling unauthorized permissions on numerous Qualcomm Snapdragon platforms. Affected families include Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and related configurations a...

CVE-2018-13910

CVE-2018-13910 describes an out-of-bounds access in TZ caused by an invalid index used to check against DDR, affecting a wide range of Qualcomm Snapdragon SoCs (e.g., IPQ8074, MDM9xxx, MSM8xxx/SD platforms) and devices listed in the CVE. The root cause is an invalid index calculation that can lea...

CVE-2019-10529

CVE-2019-10529 is a use-after-free race in Qualcomm’s KGSL kernel path when marking user entries dirty via set_page_dirty, occurring if page->mapping is freed concurrently. It affects Snapdragon/KGSL GPU components and is associated with a documented exploit (exploit-db 46941). The provided do...

CVE-2018-11976

The CVE-2018-11976 issue is described in multiple sources as an ECDSA key leakage vulnerability in Qualcomm’s secure environment. Findings indicate that private keys could be exposed from the secure world to the non-secure world via the Qualcomm Secure Execution Environment (QSEE) on Snapdragon-b...

CVE-2015-9222

CVE-2015-9222 corresponds to RomPager Misfortune Cookie authentication bypass. Affected: RomPager

CVE-2018-11271

CVE-2018-11271 is an improper authentication vulnerability affecting Qualcomm Snapdragon platforms (broad range of Snapdragon Auto/Compute/Connectivity/IoT families and related devices). The issue relates to remote command handling caused by improper event handling, enabling potential unauthorize...

CVE-2016-10439

The CVE-2016-10439 issue is a TOCTOU vulnerability in the bulletin_board_read input validation on Qualcomm Snapdragon Automotive and Mobile platforms (SD 425, 430, 450, 625, 650/52, 820, 820A) where a pointer dereference may be validated after the HLOS could modify the pointer. Affected Android r...

CVE-2018-13886

Technical details about CVE-2018-13886 are not publicly available in the provided documents; no affected products, versions, or fixes are specified here. Monitor for updates.

CVE-2018-11940

CVE-2018-11940 is a Qualcomm WLAN Host vulnerability caused by a lack of length validation before memcpy in the WLAN function, leading to out-of-bounds access in multiple Snapdragon platforms (Auto/Compute/Consumer IOT/Industrial IOT, Mobile) across listed SoCs. Connected sources confirm affected...

CVE-2019-2269

CVE-2019-2269 describes a possible buffer overflow in Qualcomm Snapdragon components when processing the high level lim process action frame due to improper buffer length validation. Affected products include Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music across numerous...

CVE-2018-11953

CVE-2018-11953 describes a potential out-of-bounds access when processing the SSID IE length from a remote AP in Qualcomm WLAN/WiFi stack. Affected are Snapdragon platforms including Auto, CE Connectivity, C IoT, Industrial IoT, IoT, Mobile, Voice & Music, and Wearables (many chipsets listed: MDM...

CVE-2018-11967

CVE-2018-11967 concerns signature verification of the skel library that could be disabled because the memory region where the library is loaded is allocated from userspace in Qualcomm/Snapdragon subsystems. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial Io...

CVE-2018-11288

CVE-2018-11288 describes a potential undefined behavior caused by a missing size check in a function parameter segment_idx, which can lead to a read outside the intended region. Affected products are Qualcomm Snapdragon lines across automotive, mobile, and wearables, including devices based on MD...

CVE-2018-13896

CVE-2018-13896 affects Qualcomm closed-source components (XBL_SEC image authentication and related crypto checks) across Snapdragon platforms. Root cause: missing lock at the XBL_SEC stage allowing a compromised OEM XBL Loader to access image authentication and crypto validations. Impact per sour...

CVE-2018-13899

CVE-2018-13899 describes a use-after-free memory fault in Qualcomm Snapdragon components when processing messages after an error, affecting a wide range of Snapdragon Auto/Compute/Connectivity/IoT/Wearables platforms (e.g., SDM630/660/665/670/675/820/845/855 and related QCS/SDA/X20/X24/X5 familie...

CVE-2019-2261

CVE-2019-2261 describes information disclosure caused by unauthorized access from the GPU subsystem to HLOS/non-secure memory. The vulnerability affects Qualcomm devices across multiple Snapdragon families (e.g., IPQ8074, MDM9xxx, MSM8xxx, SD-series including SD625/SD820/SD835/SD845/SD850, SDM43x...

CVE-2019-10506

CVE-2019-10506 concerns the QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY path in certain Qualcomm/SDP drivers where data from user space is not validated, causing undesired behavior in a wide range of Snapdragon-based devices. The issue is described as a local vulnerability with low privileges requi...

CVE-2018-13924

The CVE-2018-13924 entry concerns a buffer length validation flaw that can take negative values, causing a stack overflow in Qualcomm components across many Snapdragon platforms (Auto/Compute/Connectivity/IOT/Industrial IOT, Mobile, Wearables, etc.) including IPQ8074 family and various SD/SM/QR s...

CVE-2019-2243

CVE-2019-2243 describes a possible buffer overflow at the end of an iteration when retrieving version information, potentially leading to information disclosure. Affected components are Qualcomm Snapdragon family (across numerous Snapdragon Auto/Compute/IoT lines and related SoCs listed in the de...

CVE-2019-2275

CVE-2019-2275 centers on a buffer overflow during deserialization of a key blob in Qualcomm Snapdragon firmware (multiple Snapdragon Auto/Compute/Connectivity/Secure elements). The issue arises when key operations are invoked and depends on CVE-2018-13907. Affected components include numerous Sna...

CVE-2019-10539

CVE-2019-10539 affects Qualcomm WLAN firmware in a wide range of Snapdragon chipsets (e.g., IPQ8074, MSM8xxx, QCA... and SD-series) where a missing length check when parsing the extended cap IE header length can trigger a buffer overflow. Reports describe this as a potential remote WLAN/firmware ...

CVE-2019-10540

CVE-2019-10540 is a buffer overflow in the WLAN firmware (Qualcomm/QualPwn context) affecting multiple Snapdragon platforms, where a missing bounds check on the NAN availability attribute count enables overrun in the WLAN/NAN path. Affected hardware includes IPQ8074, MSM8996AU, QCA6174A, QCA6574A...

CVE-2018-11968

CVE-2018-11968 is described as an integer overflow due to an improper check before assigning a value in Qualcomm/Snapdragon components (including IPQ4019 through SD variants). The impact is high for confidentiality, integrity, and availability per CVSS, with local attack possible and low complexi...

CVE-2018-13927

CVE-2018-13927 concerns Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/Connectivity/IOT/Mobile/related SDMs) where the debug policy with invalid signature could be loaded even when debug policy is disabled by using parallel image loading. The issue is described consistently acros...

CVE-2019-10542

The CVE-2019-10542 issue affects a wide range of Qualcomm Snapdragon firmware components (e.g., Snapdragon Auto, Consumer Electronics Connectivity, Snapdragon Mobile, etc.). Root cause is a mismatch between the chunk length in the firmware header and the actual contents, leading to a possible buf...

CVE-2019-2244

CVE-2019-2244 affects Qualcomm Snapdragon firmware components across a wide range of SoCs. The issue is a possible integer underflow when calculating the length of elementary stream info from an invalid section length, which is then used to read from the input buffer. Impact is described as poten...

CVE-2019-2279

CVE-2019-2279 affects Qualcomm/Snapdragon components (e.g., Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT, Snapdragon Mobile, Wearables, and related SoCs such as MDM9150, MDM9607, MDM9650, various SDx/SDM/QCA families). Root cause: shared memory is updated with invalid data, causing me...

CVE-2019-2323

CVE-2019-2323 describes a lack of validation of user-passed crypto engine data, which can lead to a bus error in Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Voice & Music, Wearables) across numerous SDM/SDX/SD platforms. Root cause is uninitia...

CVE-2014-9986

CVE-2014-9986 concerns Android devices with Qualcomm components (e.g., Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear MSM8909W, SD系列) where in playready_licacq_process_response(), the length of the cbResponse is not validated and is controlled by the HLOS. If cbResponse is too large, a...

CVE-2016-10479

The CVE-2016-10479 issue affects Android devices on Qualcomm Snapdragon platforms (including MDM9607/MDM9615/MDM9635M/MDM9640 and SD 210/212/205, 400, 600, 615/16/415, 617, 650/52, 800, 810, 820) where an arbitrary length value from an incoming message to the QMI Proxy can cause an out-of-bounds ...

CVE-2017-18317

CVE-2017-18317 affects Qualcomm closed‑source components in Snapdragon Automotive and Snapdragon Mobile (MSM8996AU, SD 410/12, SD 820, SD 820A). The issue allows bypass of modem restrictions (sim lock/sim kill) by manipulating the system to issue a deactivation flow sequence. The available docume...

CVE-2018-13895

CVE-2018-13895 describes an issue where missing permissions on several content providers in the RCS app’s Android manifest could enable unprivileged access on Qualcomm Snapdragon platforms (covering a broad set of Snapdragon Auto, Compute, Connectivity, IoT, Wearable, and related devices). The ro...

CVE-2018-13925

CVE-2018-13925 describes a heap-use-after-free in Qualcomm Snapdragon devices caused by an error in parsing the PMT table, where memory is freed but the context map reference is not reset. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, We...

CVE-2017-14911

CVE-2017-14911 describes a critical elevation/remote-privilege issue in Qualcomm components where the XBL loader could skip authentication of device config on several Snapdragon platforms (IoT, Mobile, Auto, and various SD/SoCs). Public records identify the affected elements as Qualcomm closed‑so...

CVE-2018-11289

CVE-2018-11289 corresponds to a data truncation causing a buffer overflow in Qualcomm/ Snapdragon components (e.g., Snapdragon Auto, Compute, Connectivity, and other Snapdragon variations). The root cause is a higher-to-lower type conversion that allocates less memory than required, enabling pote...

CVE-2018-11928

CVE-2018-11928 is a buffer-overflow vulnerability caused by a missing length parameter check when processing WMI commands in Qualcomm Snapdragon components. Affected are Snapdragon Auto/Compute/Connectivity devices (various SD/SM/QCA platforms) and related Android stack components that use Qualco...