CVE-2019-2268

CVE-2019-2268 affects Qualcomm WLAN host components in Snapdragon SoCs (multiple APQs and MSM/SDM families). It describes a possible out-of-bounds (OOB) read in P2P action frames while processing WLAN management frames. CVSS metrics in the sources show an overall HIGH impact (CVSS v2 base 7.5) an...

CVE-2019-2303

CVE-2019-2303 concerns the Qualcomm SNDCP module and related Snapdragon components. The issue is described as the module potentially accessing memory outside its boundary when handling malformed XID messages, potentially leading to memory corruption (buffer/heap overflow) in GSNDCP. Affected plat...

CVE-2019-2330

CVE-2019-2330 describes an issue with improper input validation in the allocation request for secure allocations, which can lead to a page fault on Qualcomm hardware. Affected products span multiple Qualcomm platforms (e.g., Snapdragon Auto/Compute/Mobile/IoT, IPQ4019/IPQ8064/IPQ8074, MDM9xxx, SD...

CVE-2017-18296

CVE-2017-18296 describes an access-control flaw in SafeSwitch services affecting Qualcomm/CPU platforms (Snapdragon Automobile, Mobile and Wear) across multiple SDM/SoC models. The root cause is improper access control allowing local escalation with complete confidentiality/integrity/availability...

CVE-2018-11824

CVE-2018-11824 describes a stack-based buffer overflow in a firmware routine of Qualcomm/ Snapdragon components ( Snapdragon Mobile, Snapdragon Wear ) affecting multiple platform variants (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 835, SD 845, SD 850, SDA660). The root cause is a overflow in ...

CVE-2018-11922

Technical details (affected product/version, root cause, impact, fixes) for CVE-2018-11922 are not publicly available in the provided connected documents. Monitor for updates from vendors and security bulletins.

CVE-2018-12013

CVE-2018-12013 : The issue is an improper authentication flaw in a locked memory region that can grant unprivileged access to memory in multiple Qualcomm Snapdragon products (e.g., Snapdragon Auto/Compute/IoT lines and various SDM/SD chips). Root cause: insufficient authentication controls within...

CVE-2018-5912

CVE-2018-5912 is a Critical, closed-source component buffer overflow in Video within Qualcomm Snapdragon firmware (MSM8996AU, etc.). Technical detail: input validation weakness in the Video path can lead to arbitrary code execution in a privileged context. Android May 2019 bulletin documents CVE-...

CVE-2018-5916

CVE-2018-5916 describes a buffer overread during PDP modify requests or network-initiated secondary PDP activation in Qualcomm Snapdragon components across Snapdragon Automotive, Mobile and Wear platforms. Affected Snapdragon families include MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...

CVE-2019-10493

CVE-2019-10493 is a critical flaw in Qualcomm closed‑source components used in Snapdragon devices (e.g., Auto/Compute/IoT/mobile/wearables). The issue degrades position determination accuracy due to wrongly decoded information across a long list of Snapdragon platforms (APQ8053, MDMs, SDMs, SXR, ...

CVE-2019-10504

CVE-2019-10504 affects Qualcomm Snapdragon firmware components (multiple Snapdragon Auto/Consumer IoT/Industrial IoT devices and related SoCs). Root cause: resource consumption leads to firmware not delivering EXT scan response to host within 1 second, impacting availability. Affected products in...

CVE-2019-10528

CVE-2019-10528 describes a use-after-free in the kernel when handling freed mdlog session info after the session is closed. Affected are Qualcomm Snapdragon platforms (including Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables families across a wide range of...

CVE-2019-10562

CVE-2019-10562 affects Qualcomm Snapdragon families (including IPQ6018, MSM CPUs) with an improper authentication and signature verification of debug policies in the secure boot loader. The root cause is insecure policy loading into secure memory, leading to memory corruption and potential local ...

CVE-2019-10593

CVE-2019-10593 is a buffer overflow vulnerability in Qualcomm Snapdragon firmware. It occurs when processing non-standard SDP video Image attribute parameters during VILTE/VOLTE calls across a wide range of Qualcomm Snapdragon platforms (Auto, Compute, IoT, Wearables, etc.). The root cause is a p...

CVE-2019-14029

CVE-2019-14029 describes a use-after-free in the graphics module caused by destroying an already queued syncobj in error handling, affecting a wide range of Qualcomm/Snapdragon devices (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables, etc.) across multiple SKUs (APQ8009,...

CVE-2019-14067

CVE-2019-14067 describes a timing side-channel information disclosure caused by using non-time-constant comparison functions (e.g., memcmp) in Qualcomm-based Snapdragon firmware. Affected products span Snapdragon Auto, Compute, Connectivity, IoT, Wearables, and related SoCs (including APQ8009/801...

CVE-2019-14098

CVE-2019-14098 describes a buffer overflow in Qualcomm Snapdragon data offload handling due to an missing check of keydata length during data copying, affecting Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (numerous SoCs). Root cause: lack of validation of keydata leng...

CVE-2019-14110

CVE-2019-14110 describes a buffer overflow in WLAN firmware when copying association frame content in SAP mode for Qualcomm Snapdragon devices (wide range of APQ/SDM/SC variants). Root cause: copying association frames exceeds the maximum destination buffer, enabling a potential overflow. Impact ...

CVE-2019-2258

CVE-2019-2258: Improper validation of array index causes out-of-bounds write and memory corruption in MMCP within Qualcomm Snapdragon family devices (Auto, Compute, IoT, Wearables, etc.). Impact spans numerous Snapdragon platforms (MDM9xxx, SDX20, SDM6xx/8xx, etc.), across multiple SoCs listed in...

CVE-2019-2271

CVE-2019-2271 is a buffer over-read in Qualcomm closed-source components used across Snapdragon lineups (e.g., APQ8009/8017/8053/8096A U, SDM/SM/SC families). It can occur when parsing downlink OTA messages with unintended network values, potentially enabling remote code execution or other impact...

CVE-2019-2283

An out‑of‑bounds access vulnerability in Qualcomm Snapdragon devices results from improper validation of the read/write index of TX/RX FIFOs before pointer calculation. The issue affects a broad set of Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Weara...

CVE-2019-2295

CVE-2019-2295 describes information disclosure caused by a missing address range check in the SysDBG buffers within SDI code. The weakness affects Qualcomm Snapdragon platforms across multiple families (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice ...

CVE-2019-2321

CVE-2019-2321 describes an incorrect length validation in the QSEE log buffer handling that could cause a remap conflict across a wide range of Qualcomm Snapdragon platforms (listed in the description: includes numerous Snapdragon Auto/Compute/Connectivity families and mobile chipsets such as APQ...

CVE-2020-11193

CVE-2020-11193 describes a buffer over-read in Qualcomm/Snapdragon video processing caused by improper typecasting of data returned from atomsize while parsing MKV clips. Affected products cover Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables, and related SoCs (e.g., APQ...

CVE-2020-11206

CVE-2020-11206 describes a possible buffer overflow in Qualcomm’s Fastrpc when handling received parameters due to insufficient input validation. Affected devices span Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, and Mobile families, including APQ8098 through SM8350P variants. Root cau...

CVE-2017-18316

CVE-2017-18316 affects Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) and is triggered via the Ontario kernel driver that can allow a secure application to access QSEE kernel memory. Affected devices/SoCs include MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430...

CVE-2018-11871

The CVE-2018-11871 entry describes a buffer overwrite in the WLAN function when processing the set pdev parameter, caused by insufficient input validation in Qualcomm Snapdragon components (Snapdragon Automobile/Mobile/Wear) across a long list of IPQ/SDM/QCA platforms (e.g., IPQ4019, IPQ8064, IPQ...

CVE-2018-11948

CVE-2018-11948 affects Qualcomm Snapdragon platforms listed (MSM8996AU, QCS605, SD 410/12, SD 425/427/430/435/439/SD 429, SD 450, SD 625/632/636/675, SD 712/710/670/820/820A/835/845/SD 850, SD 8CX, SDA660, SDM439/630/660, Snapdragon_High_Med_2016, SXR1130) where the issue is that usage-entry limi...

CVE-2018-3595

CVE-2018-3595 affects Qualcomm Snapdragon platforms (automobile/mobile/wear) across multiple SoCs (e.g., MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/212/205, 425, 430, 450, 625, 650/52, 712/710/670, 820/820A, 835/845/850, 660, SDX24, SXR1130). The vulnerability arises from improper error handlin...

CVE-2018-5915

CVE-2018-5915 : Exception in the Modem IP stack while processing IPv6 packets affects Qualcomm/Qualcomm-based Snapdragon automotive, mobile, and wearables platforms (MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/212/205, SD 425, SD 430, SD 712/710/670, SD 820/820A/835/845/850, SDA660, SD...

CVE-2019-10483

CVE-2019-10483 describes a side-channel vulnerability in Qualcomm’s QTEE due to non-time-constant comparisons (memcpy-like memcmp/strcmp) used across Snapdragon platforms (Auto, Compute, Connectivity, etc. including APQ8009, SDM, SM, and other family seeds). Root cause: non-constant-time comparis...

CVE-2019-10522

CVE-2019-10522 affects a wide range of Qualcomm Snapdragon devices across multiple SoCs (e.g., SD 210/212/205, 625, 665, 710/670, 820/820A, 835/850, 855, and many others) due to a nonstandard buffer overflow in the clip parsing path. The issue is triggered while playing a clip and could impact co...

CVE-2019-10559

CVE-2019-10559 affects Qualcomm/Snapdragon media stack: a data buffer over-read while parsing an ogg clip can trigger a null-pointer dereference, leading to memory corruption in Snapdragon Auto, Compute, Connectivity, and related devices (wide list of Qualcomm platforms). The Red Hat/PRION refere...

CVE-2019-10563

CVE-2019-10563 describes a buffer over-read in the fast message handler when processing a firmware message in Qualcomm Snapdragon firmware across multiple platforms (APQ8053, APQ8096AU, MSM8996AU, MSM8998, QCN7605, QCS405, QCS605, SDA660, SDM636, SDM660, SDX20, SDX24, etc.). Root cause: improper ...

CVE-2019-10604

CVE-2019-10604 describes a heap-buffer-overflow in Snapdragon’s diag command response handling where the last loop iteration on populating image version information can overflow a heap buffer. Affected platforms span numerous Snapdragon Auto/IoT devices (APQ8053, APQ8096AU, APQ8098, MDM9607, …, S...

CVE-2019-14007

CVE-2019-14007 describes a timing side-channel issue caused by non-time-constant comparison functions affecting Qualcomm Snapdragon components (closed-source) across multiple devices. The underlying problem could enable a local attacker to infer sensitive information (SUI-related) due to timing d...

CVE-2019-14037

CVE-2019-14037 is a Use-After-Free vulnerability arising from close and bind operations on sockets in several Qualcomm/Snapdragon kernels. Connected sources (NVD, Red Hat, CVE list, PRION, ENISA EUVD, and Android Pixel bulletin) confirm the issue affects a wide range of Snapdragon/SoC families (e...

CVE-2019-14062

CVE-2019-14062 is a buffer overflow in how a setup message from the Network is decoded in various Qualcomm/Snapdragon components (listed in the description). Root cause: lack of validation of IE message length during network processing in multiple Snapdragon SoCs and related devices. Public sourc...

CVE-2019-14083

CVE-2019-14083 is a Qualcomm/Snapdragon vulnerability where parsing the Service Descriptor Extended Attribute in SDF frames can misinterpret the attribute length, causing an integer underflow. Affected: Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Indus...

CVE-2019-2334

CVE-2019-2334 is a null pointer dereference in Snapdragon media handling that can occur when playing a clip with a wrong block group id, affecting a broad set of Qualcomm Snapdragon products (Auto, Compute, IoT, Mobile, Wearables, etc.). The NVD and Red Hat entries rate it as HIGH severity with C...

CVE-2020-3684

CVE-2020-3684 describes a local, privilege-relevant issue in Qualcomm Snapdragon platforms where QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by the XBL Loader and applies them without validation. This affects a wide range of Snapdragon p...

CVE-2017-18124

CVE-2017-18124 : The description in the linked sources states that during secure boot an addition is performed on uint8 pointers, causing an overflow. This affects a broad set of Qualcomm/Snapdragon devices (e.g., FSM9055, IPQ4019, MDM9xxx, MSM/SDA/XOA families and many SD series SKUs). The conne...

CVE-2018-11287

CVE-2018-11287 affects Qualcomm Video components in Snapdragon/Qualcomm closed‑source stack (mobile, automotive, wearables) across listed SDM/SM and Snapdragon platforms. Root cause is an incorrect control flow when verifying buffer sufficiency in video processing, enabling potential abuse within...

CVE-2018-11949

CVE-2018-11949 describes a failure to initialize an extra buffer that can lead to an out-of-bounds access in the WLAN function of Qualcomm Snapdragon components (WLAN HOST) across multiple Snapdragon family devices. The affected scope includes Snapdragon Auto, Compute, Consumer IOT, Industrial IO...

CVE-2018-5867

CVE-2018-5867 relates to a buffer overflow caused by lack of input-size checking in WideVine on Qualcomm/Snapdragon platforms (automotive, mobile, wearables). Affected products include a broad list of Snapdragon/SDM/SDX devices (e.g., MDM9206, MDM9607, SD 210–SD 850 families, SDX24, Snapdragon_Hi...

CVE-2018-5870

CVE-2018-5870 concerns Snapdragon Mobile: an untrusted pointer dereference during loading of a service image affects select Qualcomm SoCs (SD835, SDA660, SDX24). The NVD entry lists a high base score (CVSSv3: 7.8, LOCAL attack, LOW privileges required, no user interaction) with impact on confiden...

CVE-2019-10555

CVE-2019-10555 is a buffer overflow affecting Qualcomm Snapdragon line devices (across Snapdragon Auto/Compute/Consumer Electronics Connectivity/IoT/Industrial IoT/Mobile/Wearables) via incorrect datatype usage and missing length checks when copying into buffers. Affected components are broadly i...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

CVE-2019-10609

CVE-2019-10609 affects Qualcomm closed‑source components with an out‑of‑bounds write caused by insufficient array index checks during calculation. Publicly listed in Red Hat and NVD records as a critical issue affecting numerous Qualcomm/Snapdragon subcomponents (e.g., APQ/SDM series). Root cause...

CVE-2019-14071

CVE-2019-14071 affects Qualcomm/Snapdragon components where the reset handler can bypass access control if the AC configuration is reset while debug path for RAM dumps is enabled. The issue is described across multiple sources (NVD, Red Hat, PRION, CIRCL) with same core summary, listing affected ...