CVE-2019-2292

CVE-2019-2292 affects Qualcomm WLAN Host components in Snapdragon devices (e.g., Snapdragon Auto/Consumer IoT/Industrial IoT and mobile families listed). Root cause: out-of-bounds access due to buffer copy without checking input size received from WLAN firmware. Impact: potential local code execu...

CVE-2020-3622

CVE-2020-3622 refers to a vulnerability where a channel name string read from shared memory can be manipulated but not NULL-terminated, leading to potential memory corruption in Qualcomm Snapdragon components. Affected families include Snapdragon Auto/Compute/Connectivity, various Snapdragon SoCs...

CVE-2018-11820

CVE-2018-11820 concerns a side-channel leak caused by using a non-time-constant memcmp function in Qualcomm/Snapdragon components. Affected platforms include Snapdragon Auto/Compute/Connectivity, Snapdragon IoT lines and many SDM/SD/SDM variants (e.g., IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640,...

CVE-2018-11971

CVE-2018-11971 concerns an interrupt exit code flow issue that may undermine the TrustZone access control on Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer devices and various Qualcomm SoCs). Descriptions across sources consistently state risk of secure asset leakage within...

CVE-2018-12004

CVE-2018-12004 affects Qualcomm Snapdragon-based mobile/embedded platforms (e.g., Snapdragon Auto, Compute, Consumer Electronics Connectivity, IOT, Industrial IOT, Mobile, Wearables) and related SoCs (e.g., SDM63x/SD 210–SD 845 family). The vulnerability description indicates that the secure keyp...

CVE-2019-10530

CVE-2019-10530 involves a kernel-level buffer overflow caused by a missing check for data truncation in Qualcomm Snapdragon kernel components. Affected are numerous Snapdragon families (Auto, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables) across many SDM and Snapdragon Snapdragon...

CVE-2019-10577

CVE-2019-10577 is a buffer over-read caused by improper input validation when processing SIP URIs in Qualcomm Snapdragon modem/processor families (e.g., Snapdragon Auto, Compute, IoT, Mobile, Wearables). The issue can lead to denial of service. Affected products span numerous Qualcomm platforms l...

CVE-2019-14015

CVE-2019-14015 affects Snapdragon platforms (multiple APQ/SDM variants) where a stack-based buffer overflow occurs during the identification stage initialization due to inadequate validation of the number of templates. This vulnerability is rated HIGH (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A...

CVE-2019-14038

CVE-2019-14038 is a buffer over-read in the ADSP parse function caused by a missing check for sufficient data payload in a Qualcomm Snapdragon ADSP command response. Affected are Snapdragon products across multiple lines (Auto, Compute, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, We...

CVE-2019-2323

CVE-2019-2323 describes a lack of validation of user-passed crypto engine data, which can lead to a bus error in Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Voice & Music, Wearables) across numerous SDM/SDX/SD platforms. Root cause is uninitia...

CVE-2020-3626

CVE-2020-3626 affects Qualcomm closed‑source components on various Snapdragon platforms (e.g., APQ8053, SDM/SM variants). The underlying issue is reported as an authentication flaw where the AIDL uimlpaservice has insufficient protection, allowing any application to bind to the service and exerci...

CVE-2017-18298

CVE-2017-18298 describes a lack of input validation in the SDMX API that can cause NULL pointer dereference in Qualcomm Snapdragon platforms listed (e.g., MDM9206/9607/9650; MSM8996AU; SD 210/212/205, 410/12, 425, 430, 450, 615/16/ SD 415, 617, 625, 650/52, 810, 820/820A, 835, 845, 850, SDA660). ...

CVE-2017-18314

CVE-2017-18314 affects Qualcomm closed‑source components. The entry notes that on TZ cold boot the CNOC_QDSS RG0, which is locked by xBL_SEC, is cleared by TZ. This is categorized as a Critical issue in the Qualcomm closed‑source component list and is referenced in Android/industry bulletins. The...

CVE-2018-11966

CVE-2018-11966 affects Qualcomm Snapdragon platforms (Auto/Compute/IoT/Wearables/SXR1130 family and multiple SDMs) across numerous devices (e.g., SD 210–DDR list, 625, 632, 650/52, 675, 712/710/670, 820/820A, 835/850, 855, 9120-era GPUs) due to undefined behavior in UE when processing an unknown ...

CVE-2018-12013

CVE-2018-12013 : The issue is an improper authentication flaw in a locked memory region that can grant unprivileged access to memory in multiple Qualcomm Snapdragon products (e.g., Snapdragon Auto/Compute/IoT lines and various SDM/SD chips). Root cause: insufficient authentication controls within...

CVE-2018-13912

CVE-2018-13912 describes an Arbitrary write in Qualcomm camera components when a kernel address is provided in compat mode on a wide range of Snapdragon platforms (e.g., Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables; various SDM/SD variants). The issue ap...

CVE-2018-13916

CVE-2018-13916 describes an out-of-bounds memory access in a Qurt kernel function when using an identifier to access a Qurt kernel buffer to retrieve thread data. The vulnerability affects Qualcomm/Snapdragon platforms (e.g., APQ8009/ MSM9xxx series, SDM/SDX lines and related Qualcomm components)...

CVE-2019-10494

CVE-2019-10494 is a race condition in the camera function stack due to missing resource locks, leading to memory corruption and a use-after-free in Qualcomm/Snapdragon device families (APQ8009, APQ8017, APQ8053, … SM8150). The issue affects Snapdragon Auto, Snapdragon Mobile, and related SoCs; Re...

CVE-2019-10552

CVE-2019-10552 describes a buffer over-read in Qualcomm’s Snapdragon components due to improper length checks when decoding Service Reject/RAU Reject/PTMSI Realloc commands. Affected are Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables, a...

CVE-2019-10554

CVE-2019-10554 describes Multiple Read overflows due to improper length checks during Identity Request decoding in the CS domain flow across numerous Snapdragon products (Auto/Compute/Connectivity/IoT/etc). Root cause stated as length check issues during decoding, enabling potential overflow cond...

CVE-2019-10610

CVE-2019-10610 affects Qualcomm/Snapdragon video components where a buffer over-read can occur while parsing an SDP video media line with a frame-size attribute. Affected products include a wide range of Snapdragon Auto/Compute/IoT platforms (APQ/MDM/SC/SDM lines). The root cause is an over-read ...

CVE-2019-10615

CVE-2019-10615 describes an integer overflow in keymaster 4 during memory allocation caused by multiplying a large numcerts value by the size of the keymaster blob, potentially leading to memory corruption on a wide set of Snapdragon-based devices (APQ8009/8017/8053/8096A U and many more). The is...

CVE-2019-14028

CVE-2019-14028 is a Qualcomm Snapdragon vulnerability: a buffer overwrite during memcpy caused by a missing SSID length validation in multiple Snapdragon components (Auto, Compute, Connectivity, and related Snapdragon families on various SoCs). Root cause documented as lack of check on SSID lengt...

CVE-2019-14056

CVE-2019-14056 describes a possible integer overflow in an API caused by no check on large oid range counts in a cert extension field, affecting a wide range of Snapdragon chipsets (Auto, Compute, IoT, Mobile, etc.). The root cause is overflow when handling large OID range counts in cert extensio...

CVE-2019-14127

CVE-2019-14127 : A possible buffer overflow during MKV playback due to improper validation of the atom size buffer in Qualcomm Snapdragon video paths (Snapdragon Auto/Compute/Consumer IoT/Industrial IoT/Mobile/Wearables, etc.) affecting a wide range of Snapdragon families (APQ, MDM, MSM, Nicobar/...

CVE-2017-18304

CVE-2017-18304 involves Insufficient memory allocation in boot due to an incorrect size being passed, causing out-of-bounds access. The affected devices span Qualcomm Snapdragon-family platforms and SoCs, including Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear acro...

CVE-2017-18311

CVE-2017-18311 concerns a privilege-escalation flaw in the XPU Master caused by improper access control of unused xPU ports that remain open. Affected products span Snapdragon Automotive, Mobile, and Wear lines (listed chipsets such as MDM9607/9635M/9640/9645/9650/9655, MSM89xx/SD-series includin...

CVE-2018-11824

CVE-2018-11824 describes a stack-based buffer overflow in a firmware routine of Qualcomm/ Snapdragon components ( Snapdragon Mobile, Snapdragon Wear ) affecting multiple platform variants (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 835, SD 845, SD 850, SDA660). The root cause is a overflow in ...

CVE-2019-10485

CVE-2019-10485 involves an infinite loop when decoding compressed data that can cause an overrun condition in various Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.). The issue affects a broad set of Qualcomm/Snapdragon components and is driven by a decoding loop condition, as ...

CVE-2019-10504

CVE-2019-10504 affects Qualcomm Snapdragon firmware components (multiple Snapdragon Auto/Consumer IoT/Industrial IoT devices and related SoCs). Root cause: resource consumption leads to firmware not delivering EXT scan response to host within 1 second, impacting availability. Affected products in...

CVE-2019-10546

CVE-2019-10546 describes a buffer overflow in WLAN firmware when parsing beacon/probe_response frames during roaming on Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, and others including APQ8096/.. SXR2130). Affected hardware spans numerous Snapdragon SoCs, including IPQ/MDM/SDM fam...

CVE-2019-10551

CVE-2019-10551 describes a string processing error in non-standard SIP messages that can cause a buffer overread and denial of service on Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, IoT, Mobile, Wearables) across numerous Snapdragon families. The vulnera...

CVE-2019-10594

CVE-2019-10594 is a stack overflow vulnerability in Snapdragon media SDP handling when FMTP in an M-line carries multiple payload types. Affected are Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables across numerous SoC families (APQ, MDM, MSM variants)...

CVE-2019-14011

CVE-2019-14011 concerns multiple Read overflow issues caused by improper length checks during decoding of 3G attach accept/SMS/PDN connection reject/esm data transport/bearer modify context reject in Qualcomm Snapdragon lineups (Auto, Compute, IoT, Wearables, etc.) across numerous SoCs and produc...

CVE-2019-14018

CVE-2019-14018 is a Qualcomm/Snapdragon component issue described as a possible out-of-bounds array access caused by no carrier index check in Snapdragon Auto/Compute/IoT/mobile wearable stacks (multiple Snapdragon/MDM/SC families listed). NVD/Red Hat entries indicate a local attack surface with ...

CVE-2019-14070

The CVE-2019-14070 entry is supported by connected docs showing a Qualcomm/Android exposure in the Audio path. It describes a race condition causing a use-after-free in PCM volume controls within Qualcomm Snapdragon platform audio controls. Affected scope includes Snapdragon Auto/Compute/Consumer...

CVE-2019-14098

CVE-2019-14098 describes a buffer overflow in Qualcomm Snapdragon data offload handling due to an missing check of keydata length during data copying, affecting Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (numerous SoCs). Root cause: lack of validation of keydata leng...

CVE-2019-2268

CVE-2019-2268 affects Qualcomm WLAN host components in Snapdragon SoCs (multiple APQs and MSM/SDM families). It describes a possible out-of-bounds (OOB) read in P2P action frames while processing WLAN management frames. CVSS metrics in the sources show an overall HIGH impact (CVSS v2 base 7.5) an...

CVE-2020-11193

CVE-2020-11193 describes a buffer over-read in Qualcomm/Snapdragon video processing caused by improper typecasting of data returned from atomsize while parsing MKV clips. Affected products cover Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables, and related SoCs (e.g., APQ...

CVE-2018-11838

CVE-2018-11838 describes a possible double-free in the WLAN stack due to insufficient memory-free-condition checking in Qualcomm Snapdragon platforms, affecting Qualcomm WLAN components across Snapdragon families (e.g., APQ8053, MDM9640, SDA660, SDM636/660/SDX20) and various Snapdragon product li...

CVE-2018-11870

Technical details for CVE-2018-11870 are not publicly available in the provided documents. No affected products, impact, or remediation are specified here. Monitor for updates from the provided sources.

CVE-2018-11945

CVE-2018-11945 is a heap overflow due to improper input validation in the wireless service messaging module that processes data from broadcast messages. The flaw affects Qualcomm/Snapdragon families (e.g., Snapdragon Auto, Compute, Consumer Electronics Connectivity, Snapdragon IoT, and related mo...

CVE-2018-5912

CVE-2018-5912 is a Critical, closed-source component buffer overflow in Video within Qualcomm Snapdragon firmware (MSM8996AU, etc.). Technical detail: input validation weakness in the Video path can lead to arbitrary code execution in a privileged context. Android May 2019 bulletin documents CVE-...

CVE-2019-10522

CVE-2019-10522 affects a wide range of Qualcomm Snapdragon devices across multiple SoCs (e.g., SD 210/212/205, 625, 665, 710/670, 820/820A, 835/850, 855, and many others) due to a nonstandard buffer overflow in the clip parsing path. The issue is triggered while playing a clip and could impact co...

CVE-2019-10533

CVE-2019-10533 describes an out-of-bounds access due to improper validation of an array index that corrupts an index table entry in Qualcomm/Snapdragon components (numerous SoCs and modems across Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables portfolios). Conne...

CVE-2019-10562

CVE-2019-10562 affects Qualcomm Snapdragon families (including IPQ6018, MSM CPUs) with an improper authentication and signature verification of debug policies in the secure boot loader. The root cause is insecure policy loading into secure memory, leading to memory corruption and potential local ...

CVE-2019-10563

CVE-2019-10563 describes a buffer over-read in the fast message handler when processing a firmware message in Qualcomm Snapdragon firmware across multiple platforms (APQ8053, APQ8096AU, MSM8996AU, MSM8998, QCN7605, QCS405, QCS605, SDA660, SDM636, SDM660, SDX20, SDX24, etc.). Root cause: improper ...

CVE-2019-10586

CVE-2019-10586 describes a buffer overflow caused by filling media attribute tag names without validating the destination buffer size. Affected components span Qualcomm/Snapdragon families (e.g., Snapdragon Auto/Compute/IoT, MDM9150, MDM9205/9206/9607/9615/9625/9635M/9640/9645/9650/9655, MSM89x, ...

CVE-2019-10588

CVE-2019-10588 involves copying RTCP messages into an output buffer without validating the destination size, enabling a remote stack overflow. Affected are Qualcomm/Snapdragon platforms (multiple SoCs and product lines) across Snapdragon Auto, Compute, IoT, Wearables, and related drivers. Root ca...

CVE-2019-14019

CVE-2019-14019 involves Qualcomm Snapdragon components across multiple SoCs. The root cause is a read overflows issue due to an improper length check when decoding RAU accept/PDN disconnect Modify EPS/ bearer resource allocations and related requests. The impact is a high/severe condition reporte...