CVE-2019-2303

CVE-2019-2303 concerns the Qualcomm SNDCP module and related Snapdragon components. The issue is described as the module potentially accessing memory outside its boundary when handling malformed XID messages, potentially leading to memory corruption (buffer/heap overflow) in GSNDCP. Affected plat...

CVE-2019-2330

CVE-2019-2330 describes an issue with improper input validation in the allocation request for secure allocations, which can lead to a page fault on Qualcomm hardware. Affected products span multiple Qualcomm platforms (e.g., Snapdragon Auto/Compute/Mobile/IoT, IPQ4019/IPQ8064/IPQ8074, MDM9xxx, SD...

CVE-2020-11193

CVE-2020-11193 describes a buffer over-read in Qualcomm/Snapdragon video processing caused by improper typecasting of data returned from atomsize while parsing MKV clips. Affected products cover Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables, and related SoCs (e.g., APQ...

CVE-2020-3610

CVE-2020-3610 describes a double-free in a drawobj added to the drawqueue during IOCTL handling, due to a missing refcount for the object in multiple Snapdragon products (APQ8009/8053/8096AU/8098, MSM89xx, SDM4xx/6xx/7xx, SM8xxx, SXR2130, and related Qualcomm/Android platforms). The Red Hat and N...

CVE-2020-3663

CVE-2020-3663 affects Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/Connectivity/IoT/Wearables generations) where buffer over-run can occur while fetching track decoder information if the decode- cb size exceeds the allocated buffer. The issue’s root cause is a buffer overflow i...

CVE-2025-47379

Summary: CVE-2025-47379 describes memory corruption and potential use-after-free when multiple threads access a shared buffer in parallel due to improper synchronization between assignment and deallocation. The CVSSv3.1 base score is 7.8 (HIGH), with local attack vector, low attack complexity, an...

CVE-2017-18141

CVE-2017-18141 describes a local elevation of privilege in Qualcomm closed‑source components used across many Snapdragon platforms (e.g., IPQ8074, MDM9xxx, SDx and related SoCs) where loading a third‑party TEE enables the non‑secure world to invoke a secure monitor call to access privileged funct...

CVE-2018-11824

CVE-2018-11824 describes a stack-based buffer overflow in a firmware routine of Qualcomm/ Snapdragon components ( Snapdragon Mobile, Snapdragon Wear ) affecting multiple platform variants (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 835, SD 845, SD 850, SDA660). The root cause is a overflow in ...

CVE-2018-11966

CVE-2018-11966 affects Qualcomm Snapdragon platforms (Auto/Compute/IoT/Wearables/SXR1130 family and multiple SDMs) across numerous devices (e.g., SD 210–DDR list, 625, 632, 650/52, 675, 712/710/670, 820/820A, 835/850, 855, 9120-era GPUs) due to undefined behavior in UE when processing an unknown ...

CVE-2018-11999

CVE-2018-11999 concerns improper input validation in TrustZone that can cause a denial of service on Qualcomm Snapdragon platforms (automotive, mobile, wearable). Affected components are Qualcomm/TrustZone implementations across multiple Snapdragon SoCs (e.g., MDM9206, MDM9607, MDM9635M, MDM9650,...

CVE-2019-10528

CVE-2019-10528 describes a use-after-free in the kernel when handling freed mdlog session info after the session is closed. Affected are Qualcomm Snapdragon platforms (including Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables families across a wide range of...

CVE-2019-10559

CVE-2019-10559 affects Qualcomm/Snapdragon media stack: a data buffer over-read while parsing an ogg clip can trigger a null-pointer dereference, leading to memory corruption in Snapdragon Auto, Compute, Connectivity, and related devices (wide list of Qualcomm platforms). The Red Hat/PRION refere...

CVE-2019-14009

CVE-2019-14009 corresponds to an out-of-bounds memory access in the TZ command handler on Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, IOT, Mobile, etc.) caused by improper input validation of the response length from user space. Affected components include Snapdragon devices acros...

CVE-2019-14011

CVE-2019-14011 concerns multiple Read overflow issues caused by improper length checks during decoding of 3G attach accept/SMS/PDN connection reject/esm data transport/bearer modify context reject in Qualcomm Snapdragon lineups (Auto, Compute, IoT, Wearables, etc.) across numerous SoCs and produc...

CVE-2019-14019

CVE-2019-14019 involves Qualcomm Snapdragon components across multiple SoCs. The root cause is a read overflows issue due to an improper length check when decoding RAU accept/PDN disconnect Modify EPS/ bearer resource allocations and related requests. The impact is a high/severe condition reporte...

CVE-2019-14083

CVE-2019-14083 is a Qualcomm/Snapdragon vulnerability where parsing the Service Descriptor Extended Attribute in SDF frames can misinterpret the attribute length, causing an integer underflow. Affected: Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Indus...

CVE-2019-14098

CVE-2019-14098 describes a buffer overflow in Qualcomm Snapdragon data offload handling due to an missing check of keydata length during data copying, affecting Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (numerous SoCs). Root cause: lack of validation of keydata leng...

CVE-2019-14110

CVE-2019-14110 describes a buffer overflow in WLAN firmware when copying association frame content in SAP mode for Qualcomm Snapdragon devices (wide range of APQ/SDM/SC variants). Root cause: copying association frames exceeds the maximum destination buffer, enabling a potential overflow. Impact ...

CVE-2019-2292

CVE-2019-2292 affects Qualcomm WLAN Host components in Snapdragon devices (e.g., Snapdragon Auto/Consumer IoT/Industrial IoT and mobile families listed). Root cause: out-of-bounds access due to buffer copy without checking input size received from WLAN firmware. Impact: potential local code execu...

CVE-2017-18311

CVE-2017-18311 concerns a privilege-escalation flaw in the XPU Master caused by improper access control of unused xPU ports that remain open. Affected products span Snapdragon Automotive, Mobile, and Wear lines (listed chipsets such as MDM9607/9635M/9640/9645/9650/9655, MSM89xx/SD-series includin...

CVE-2018-12013

CVE-2018-12013 : The issue is an improper authentication flaw in a locked memory region that can grant unprivileged access to memory in multiple Qualcomm Snapdragon products (e.g., Snapdragon Auto/Compute/IoT lines and various SDM/SD chips). Root cause: insufficient authentication controls within...

CVE-2018-5916

CVE-2018-5916 describes a buffer overread during PDP modify requests or network-initiated secondary PDP activation in Qualcomm Snapdragon components across Snapdragon Automotive, Mobile and Wear platforms. Affected Snapdragon families include MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...

CVE-2019-10483

CVE-2019-10483 describes a side-channel vulnerability in Qualcomm’s QTEE due to non-time-constant comparisons (memcpy-like memcmp/strcmp) used across Snapdragon platforms (Auto, Compute, Connectivity, etc. including APQ8009, SDM, SM, and other family seeds). Root cause: non-constant-time comparis...

CVE-2019-10485

CVE-2019-10485 involves an infinite loop when decoding compressed data that can cause an overrun condition in various Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.). The issue affects a broad set of Qualcomm/Snapdragon components and is driven by a decoding loop condition, as ...

CVE-2019-14018

CVE-2019-14018 is a Qualcomm/Snapdragon component issue described as a possible out-of-bounds array access caused by no carrier index check in Snapdragon Auto/Compute/IoT/mobile wearable stacks (multiple Snapdragon/MDM/SC families listed). NVD/Red Hat entries indicate a local attack surface with ...

CVE-2019-14028

CVE-2019-14028 is a Qualcomm Snapdragon vulnerability: a buffer overwrite during memcpy caused by a missing SSID length validation in multiple Snapdragon components (Auto, Compute, Connectivity, and related Snapdragon families on various SoCs). Root cause documented as lack of check on SSID lengt...

CVE-2019-14037

CVE-2019-14037 is a Use-After-Free vulnerability arising from close and bind operations on sockets in several Qualcomm/Snapdragon kernels. Connected sources (NVD, Red Hat, CVE list, PRION, ENISA EUVD, and Android Pixel bulletin) confirm the issue affects a wide range of Snapdragon/SoC families (e...

CVE-2019-14071

CVE-2019-14071 affects Qualcomm/Snapdragon components where the reset handler can bypass access control if the AC configuration is reset while debug path for RAM dumps is enabled. The issue is described across multiple sources (NVD, Red Hat, PRION, CIRCL) with same core summary, listing affected ...

CVE-2019-14081

CVE-2019-14081 describes a buffer over-read in the WLAN module when handling a WMI message for SAR limits with an invalid number of limits. Affected products include Snapdragon family components (Compute/Consumer Connectivity/IoT lines and related APQ/IPQ/SDM/QCA/QCN/SDA devices). The root cause ...

CVE-2019-14101

CVE-2019-14101 affects Qualcomm Snapdragon platforms (e.g., Auto, Compute, Connectivity, IOT, Mobile, Wearables) including APQ8009/8096 families and many MSM/SDM/QCS/SXR devices. The vulnerability is an out-of-bounds read in the diag event set mask command handler when the provided length in the ...

CVE-2019-2253

CVE-2019-2253 is a buffer over-read that can occur when parsing a corrupted OGG comment block in Qualcomm Snapdragon devices (listed families). The root cause is parsing a stream with malformed metadata leading to reading beyond bounds. The description and connected documents do not provide expli...

CVE-2019-2283

An out‑of‑bounds access vulnerability in Qualcomm Snapdragon devices results from improper validation of the read/write index of TX/RX FIFOs before pointer calculation. The issue affects a broad set of Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Weara...

CVE-2019-2315

CVE-2019-2315 concerns a data handling issue in Snapdragon SoCs where parameters populated during a copy operation from a non-secure environment to a secure buffer can be exposed or mishandled. The description consistently cites copying from an fd or local buffer to a secure buffer with inputs fr...

CVE-2019-2321

CVE-2019-2321 describes an incorrect length validation in the QSEE log buffer handling that could cause a remap conflict across a wide range of Qualcomm Snapdragon platforms (listed in the description: includes numerous Snapdragon Auto/Compute/Connectivity families and mobile chipsets such as APQ...

CVE-2019-2334

CVE-2019-2334 is a null pointer dereference in Snapdragon media handling that can occur when playing a clip with a wrong block group id, affecting a broad set of Qualcomm Snapdragon products (Auto, Compute, IoT, Mobile, Wearables, etc.). The NVD and Red Hat entries rate it as HIGH severity with C...

CVE-2017-18296

CVE-2017-18296 describes an access-control flaw in SafeSwitch services affecting Qualcomm/CPU platforms (Snapdragon Automobile, Mobile and Wear) across multiple SDM/SoC models. The root cause is improper access control allowing local escalation with complete confidentiality/integrity/availability...

CVE-2017-18302

CVE-2017-18302 affects Qualcomm Snapdragon SoCs (MSM8996AU and numerous SD/i variants listed) where a crafted HLOS client can modify in-memory structures passed to a QSEE application between check and use. This leads to arbitrary writes to TZ kernel memory regions, i.e., local elevation of privil...

CVE-2018-11871

The CVE-2018-11871 entry describes a buffer overwrite in the WLAN function when processing the set pdev parameter, caused by insufficient input validation in Qualcomm Snapdragon components (Snapdragon Automobile/Mobile/Wear) across a long list of IPQ/SDM/QCA platforms (e.g., IPQ4019, IPQ8064, IPQ...

CVE-2018-11935

CVE-2018-11935 affects Qualcomm Snapdragon devices (MDM9607/9650/9655, MSM8996AU, QCS605, SD 210–SD 415/SD 636/675/712 etc.) across Snapdragon Auto, Compute, Connectivity, and IoT lines. The issue is improper input validation in the Snapdragon stack that can cause an incorrect app id to be return...

CVE-2018-11949

CVE-2018-11949 describes a failure to initialize an extra buffer that can lead to an out-of-bounds access in the WLAN function of Qualcomm Snapdragon components (WLAN HOST) across multiple Snapdragon family devices. The affected scope includes Snapdragon Auto, Compute, Consumer IOT, Industrial IO...

CVE-2018-5915

CVE-2018-5915 : Exception in the Modem IP stack while processing IPv6 packets affects Qualcomm/Qualcomm-based Snapdragon automotive, mobile, and wearables platforms (MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/212/205, SD 425, SD 430, SD 712/710/670, SD 820/820A/835/845/850, SDA660, SD...

CVE-2019-10493

CVE-2019-10493 is a critical flaw in Qualcomm closed‑source components used in Snapdragon devices (e.g., Auto/Compute/IoT/mobile/wearables). The issue degrades position determination accuracy due to wrongly decoded information across a long list of Snapdragon platforms (APQ8053, MDMs, SDMs, SXR, ...

CVE-2019-10504

CVE-2019-10504 affects Qualcomm Snapdragon firmware components (multiple Snapdragon Auto/Consumer IoT/Industrial IoT devices and related SoCs). Root cause: resource consumption leads to firmware not delivering EXT scan response to host within 1 second, impacting availability. Affected products in...

CVE-2019-10522

CVE-2019-10522 affects a wide range of Qualcomm Snapdragon devices across multiple SoCs (e.g., SD 210/212/205, 625, 665, 710/670, 820/820A, 835/850, 855, and many others) due to a nonstandard buffer overflow in the clip parsing path. The issue is triggered while playing a clip and could impact co...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

CVE-2019-10604

CVE-2019-10604 describes a heap-buffer-overflow in Snapdragon’s diag command response handling where the last loop iteration on populating image version information can overflow a heap buffer. Affected platforms span numerous Snapdragon Auto/IoT devices (APQ8053, APQ8096AU, APQ8098, MDM9607, …, S...

CVE-2019-10609

CVE-2019-10609 affects Qualcomm closed‑source components with an out‑of‑bounds write caused by insufficient array index checks during calculation. Publicly listed in Red Hat and NVD records as a critical issue affecting numerous Qualcomm/Snapdragon subcomponents (e.g., APQ/SDM series). Root cause...

CVE-2019-14050

CVE-2019-14050 describes an out-of-bounds write caused by a missing buffer-size check, leading to a buffer overflow on 32-bit architectures. Affected products include Qualcomm Snapdragon platforms across Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice/Music, and Networking offerings (v...

CVE-2019-14062

CVE-2019-14062 is a buffer overflow in how a setup message from the Network is decoded in various Qualcomm/Snapdragon components (listed in the description). Root cause: lack of validation of IE message length during network processing in multiple Snapdragon SoCs and related devices. Public sourc...

CVE-2019-14067

CVE-2019-14067 describes a timing side-channel information disclosure caused by using non-time-constant comparison functions (e.g., memcmp) in Qualcomm-based Snapdragon firmware. Affected products span Snapdragon Auto, Compute, Connectivity, IoT, Wearables, and related SoCs (including APQ8009/801...