CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2021-1931

CVE-2021-1931 is a buffer overflow in Qualcomm SDM660 bootloader processing of fastboot/flash data. The exploit arose from improper handling of large payloads in the bootloader’s flash: command, enabling memory corruption that could bypass signature checks and unlock the bootloader on SDM660 devi...

CVE-2020-11239

CVE-2020-11239 describes a use-after-free when importing a DMA buffer using the CPU address due to an attachment not being cleaned up. Affected are Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root caus...

CVE-2021-1945

CVE-2021-1945 describes a possible out-of-bounds read in Qualcomm Snapdragon firmware, caused by a missing length check for the Bandwidth-NSS IE across multiple Snapdragon lines (Auto/Compute/Connectivity/IoT/Industrial IoT/Mobile/Voice & Music/ Wired Infrastructure). The vulnerability affects Qu...

CVE-2020-11272

CVE-2020-11272 is a high-severity flaw affecting Qualcomm WLAN components in Snapdragon-based devices. The root cause is a use-after-free condition caused by deleting an entry in a hash table before enqueuing a frame to the PE queue, which can lead to use of a stale object. Documented impact span...

CVE-2020-11240

CVE-2020-11240 describes a memory corruption issue in Qualcomm Snapdragon components triggered by an ioctl command with an incorrect copy size. The vulnerability affects a broad set of Snapdragon products (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables...

CVE-2021-1940

CVE-2021-1940 affects Qualcomm Snapdragon devices across multiple product lines. The root cause is improper handling of responses from firmware, leading to a use-after-free condition that can impact confidentiality, integrity, and availability. The connected documents confirm the issue and impact...

CVE-2021-1955

CVE-2021-1955 describes a Denial of Service in Qualcomm’s Snapdragon stack caused by improper handling of connections when an association is rejected. The issue affects Snapdragon Auto/Compute/Connectivity and related Snapdragon lines (IoT, Wearables, Mobile, etc.). Root cause: mishandling of con...

CVE-2021-1964

CVE-2021-1964 corresponds to a buffer over-read in Qualcomm WLAN/IEEE 802.11 beacon parsing due to improper validation of IE size in the WLAN host subsystem. Affected are Qualcomm Snapdragon/WLAN components (e.g., QCA6574AU and related chips) across multiple Snapdragon device families. Root cause...

CVE-2021-1970

CVE-2021-1970 relates to an out-of-bounds read in Qualcomm WLAN/Qualcomm Snapdragon subsystems caused by insufficient length checks for FT sub-elements. Affected products include Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music lineages and WLAN components. Th...

CVE-2020-11250

CVE-2020-11250 is a use-after-free vulnerability caused by a race condition when reopening a Snapdragon device driver repeatedly across Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables/Wired Infrastructure and Networking. Affects Qualcomm components ...

CVE-2020-11262

CVE-2020-11262 describes a race between command submission and context destruction that can cause an invalid context to be added, leading to a use-after-free condition. Reported for Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables (Qualcomm/Snapdrago...

CVE-2021-1972

CVE-2021-1972 is a Qualcomm WLAN host vulnerability described as a buffer overflow caused by improper validation of device types during P2P search in Snapdragon platforms (Auto/Compute/Connectivity/…/Wired Networking). Affected products are Qualcomm/Snapdragon WLAN components; CVSS v3.1 base scor...

CVE-2021-1941

CVE-2021-1941 corresponds to a Qualcomm WLAN issue: a possible buffer over-read caused by an improper length check on the WPA IE string, affecting multiple Snapdragon platforms (Auto/Compute/Connectivity/Consumer Electronics Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wired Infr...

CVE-2020-11301

CVE-2020-11301 describes improper authentication of unencrypted plaintext Wi‑Fi frames within encrypted networks, enabling information disclosure in Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & ...

CVE-2021-1974

CVE-2021-1974 is described in connected sources as a buffer issue (buffer over-read) due to misalignment between IPA SMMU and WLAN SMMU mapping lengths in Snapdragon platforms (Auto/Compute/Connectivity/IoT/Wearables/Networking). Qualcomm/Red Hat/NVD entries label it as high severity with network...

CVE-2021-30259

CVE-2021-30259 affects Qualcomm Snapdragon platforms (Auto/Compute/Connectivity, Consumer IoT, Industrial IoT, Mobile, Wearables, etc.) with a likely closed-source component vulnerability caused by improper validation of function table entries, leading to possible out-of-bounds access. The issue ...

CVE-2020-11190

CVE-2020-11190 describes a buffer over-read when parsing received SDP values caused by a missing NULL termination check in Qualcomm Snapdragon components. The vulnerability affects Qualcomm/Open-source SSDP handling in Snapdragon Auto, Compute, Connectivity, and related Snapdragon lines (includin...

CVE-2020-11226

CVE-2020-11226 concerns a memory-read out-of-bounds vulnerability in Qualcomm closed-source Data modem logic, stemming from a missing offset-length check during unpacking. Affected products span Snapdragon Auto/Compute/Connectivity/IoT lines (Qualcomm closed-source components). The underlying fla...

CVE-2020-11267

CVE-2020-11267 involves a stack out-of-bounds write during the setup of a cipher device when the IV length exceeds the maximum limit on Qualcomm/Snapdragon devices (Auto/Compute/Connectivity/Consumer IoT/Industrial IOT/Mobile/Voice & Music/Wearables/Wired Infrastructure). The vulnerability affect...

CVE-2021-1904

CVE-2021-1904 is an information-disclosure issue arising in Qualcomm Snapdragon components where a child process may leak information from its parent due to numeric PIDs being compared and potentially reused. The CVE entry references Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial Io...

CVE-2021-1961

CVE-2021-1961 describes a possible buffer overflow due to lack of offset length check when updating a buffer value in Qualcomm Snapdragon family components (Auto, Compute, Connectivity, Consumer / Industrial IoT, Mobile, Voice & Music, Wearables). The CVE is referenced across multiple feeds (NVD,...

CVE-2020-11189

CVE-2020-11189 is a buffer over-read vulnerability occurring while parsing SDP values due to a missing NULL termination check in Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables). The issue is triggered by network con...

CVE-2021-1888

CVE-2021-1888 describes a memory corruption issue caused by double freeing the same heap allocation in Qualcomm Snapdragon components (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, IoT, Voice & Music, Wearables) during key parsing/import. The root cause is a double free, l...

CVE-2020-11296

CVE-2020-11296 concerns an arithmetic overflow in processing NOA IE across multiple Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, etc.). Root cause is improper error handling, leading to an overflow that can impact Snapdragon families including Mobile, IoT, Automotive lines and rela...

CVE-2021-1948

CVE-2021-1948 describes a possible out-of-bounds read due to a missing length check while parsing beacon or probe responses in Qualcomm Snapdragon families (Snapdragon Auto, Compute, Connectivity, and related lines). The published entry lists an impact of high severity (availability impact) and s...

CVE-2021-1886

CVE-2021-1886 is a memory-corruption vulnerability in Qualcomm closed-source components (notably affecting Snapdragon Auto/Compute/Connectivity and other Snapdragon lines) caused by incorrect handling of pointers during trusted application key import. The issue enables local exploitation with a l...

CVE-2020-11134

CVE-2020-11134 affects Qualcomm Snapdragon family (Snapdragon Auto/Compute/Connectivity, etc.). The root cause is insufficient validation of time bitmap length and bit duration fields in NAN management frame attributes, leading to a possible stack out-of-bounds write within NAN ranging setup. The...

CVE-2020-11171

CVE-2020-11171 concerns a buffer over-read during SDP parsing caused by missing NULL termination checks in Qualcomm/Snapdragon components (Auto, Compute, Connectivity, IoT, Wearables, etc.). NVD notes a highly severe impact (CVSSv3.1: CRITICAL, CVSSv2: MEDIUM with Partial confidentiality/availabi...

CVE-2020-11222

CVE-2020-11222 is a buffer over-read in Qualcomm Snapdragon components (Auto, Compute, Connectivity, C IoT, Industrial IoT, IoT, Mobile) triggered when processing MT SMS messages at maximum length due to improper length checking. The vulnerability is described across NVD/Red Hat/PRION/CVE lists a...

CVE-2020-11227

CVE-2020-11227 describes an out-of-bounds write during RTT/TTY packet parsing caused by a missing buffer-size check prior to copying into a buffer in multiple Qualcomm/Snapdragon components (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables). Root ca...

CVE-2021-1969

CVE-2021-1969 involves improper validation of a kernel buffer address when copying data back to a user buffer, enabling kernel memory information exposure to user space on Qualcomm/Snapdragon devices. Affected components include Qualcomm kernel/driver areas used across Snapdragon Auto, Compute, C...

CVE-2020-11159

CVE-2020-11159 is a buffer over-read in Snapdragon/Qualcomm code while processing WPA/RSN IE in beacon and response frames. The flaw occurs when the IE length is shorter than the frame pointer being accessed, potentially affecting multiple Snapdragon product families (Auto, Compute, Connectivity,...

CVE-2020-11178

CVE-2020-11178 affects Qualcomm Snapdragon automotive/IoT platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wired Infrastructure & Networking). The issue arises when trusted apps overwrite CPZ memory because the TrustZone (TZ) logic only check...

CVE-2020-11228

CVE-2020-11228 affects Qualcomm closed‑source components (on Snapdragon platforms) due to an improper policy in the RPM region of xblSec, enabling unprivileged access. The issue is documented across multiple sources (NVD entry and Red Hat advisory) with explicit references to Qualcomm’s security ...

CVE-2021-1896

The CVE-2021-1896 entry concerns Qualcomm Qualcomm Snapdragon components (Compute and Connectivity) with a weak WLAN configuration that could forward unencrypted packets between peers. Available sources from NVD and Red Hat, PRION, PT Security and others indicate the vulnerability affects Snapdra...

CVE-2021-1889

CVE-2021-1889 refers to a buffer overflow condition due to a missing length check in the Trusted Application component of Qualcomm’s Snapdragon line (Auto, Compute, Connectivity, IoT, Wearables, etc.). The entry is tied to Qualcomm closed‑source components and is rated Critical in the 2021 Androi...

CVE-2020-11166

CVE-2020-11166 affects Qualcomm closed‑source components in Snapdragon stacks (Auto/Compute/Connectivity/IoT family). The vulnerability is an out-of-bounds read triggered when the UE receives an unusually large number of padding octets at the beginning of the ROHC header, leading to potential con...

CVE-2021-1953

CVE-2021-1953 is a Qualcomm/Snapdragon chipset vulnerability: improper handling of malformed FTMR request frames can cause a reachable assertion when replying with FTM1 frames, enabling a network‑based DoS against multiple Snapdragon Product families (Auto, Compute, Connectivity, etc.). The CVSS3...

CVE-2020-11126

CVE-2020-11126 affects Qualcomm closed‑source components in Snapdragon lineups, tied to WLAN frame parsing. The root cause is an out-of-bounds read caused by missing checks for body and header lengths in parsing WLAN frames across multiple Snapdragon families (Auto, Compute, Connectivity, Consume...

CVE-2020-11199

CVE-2020-11199 is linked to Qualcomm’s HLOS component and involves an information-disclosure vulnerability caused by improper access control. The issue allows a local attacker to access the EL3 stack canary by simply mapping the imem region, leading to exposure of sensitive information across mul...

CVE-2020-11218

CVE-2020-11218 describes a Denial of Service in the baseband triggered when a device configures LTE betaOffset-RI-Index. The issue stems from a lack of data validation in Qualcomm’s closed-source baseband components, affecting Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, ...

CVE-2020-11238

CVE-2020-11238 is a buffer over-read in ARP/NS parsing caused by a missing length check on received packets, affecting Qualcomm Snapdragon-based platforms across multiple product families (Auto, Compute, Connectivity, CES, IoT, Industrial IoT, Mobile, V&M, and Wired Networking). The impact is a p...

CVE-2020-11221

CVE-2020-11221 describes a local information-disclosure vulnerability in Qualcomm/ Snapdragon components where a non-secure entity can exploit insufficient checks in the syscall handler to extract secure QTEE diagnostic information in clear text. Affected families include Snapdragon Auto, Compute...

CVE-2020-11241

CVE-2020-11241 affects Qualcomm Snapdragon family components (e.g., Snapdragon Auto, Compute, Connectivity, and related Snapdragon lines) and is rooted in the NAN shared key descriptor processing when EAPOL Key length is shorter than expected. The vulnerability exposes an out-of-bounds read in th...

CVE-2020-11182

CVE-2020-11182: Affects Snapdragon/Qualcomm components where a heap overflow can occur while parsing the NAL header due to missing length validation of user-supplied data. Description explicitly lists Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, and Mobile as impacted. Ro...

CVE-2021-1890

CVE-2021-1890 is a Qualcomm/ Snapdragon-specific vulnerability: an improper length check of the RSA public exponent in the RSA import key function can cause memory corruption. Affected platforms include Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, IoT, Voice & Music, and ...

CVE-2020-11163

CVE-2020-11163 is a critical, network-exploitable buffer overflow reported in Qualcomm closed-source WLAN components used in Snapdragon platforms (Auto, Compute, Connectivity, C-IoT, Industrial IoT, Mobile). The issue stems from improper input validation when updating ikev2 parameters, enabling r...

CVE-2020-11220

CVE-2020-11220 is a TOCTOU-type issue in processing storage SCM commands where a pointer could be invalid during a specific window in Qualcomm closed-source components used in Snapdragon Auto/Compute/Connectivity/Industrial IOT/Mobile/Wired platforms. The connected documentation confirms the vuln...

CVE-2021-1938

CVE-2021-1938 concerns a Qualcomm/Snapdragon issue involving an assertion caused by improper verification when creating and deleting a peer across multiple Snapdragon subsystems (Auto, Compute, Connectivity, etc.). The root cause is described as improper verification during peer creation/deletion...