CVE-2017-18330

CVE-2017-18330 describes a buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in Qualcomm Snapdragon-based platforms (automotive, mobile, wearables) across numerous SoCs and SD/SoC families. The issue affects components implementing AES-CCM/GCM and can impact confidential...

CVE-2018-11845

CVE-2018-11845 describes the use of non-time-constant comparison functions in Qualcomm Snapdragon components (across numerous Snapdragon Auto/Compute/Connectivity lines and device families such as MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCS605, SDs 210–835, SD 8CX, and related SKU...

CVE-2018-5837

The CVE-2018-5837 entry concerns Snapdragon SoCs (IPQ8074, MDM9xxx, SD series, etc.) where MAC address randomization during probe requests is compromised by a flawed RNG that outputs repeating values far sooner than expected. The description covers the affected devices and the root cause, but the...

CVE-2018-5870

CVE-2018-5870 concerns Snapdragon Mobile: an untrusted pointer dereference during loading of a service image affects select Qualcomm SoCs (SD835, SDA660, SDX24). The NVD entry lists a high base score (CVSSv3: 7.8, LOCAL attack, LOW privileges required, no user interaction) with impact on confiden...

CVE-2019-10505

CVE-2019-10505 describes an out-of-bounds access issue when processing a non-standard IE measurement request whose length crosses the frame boundary in Qualcomm Snapdragon platforms. Affected are a wide range of Snapdragon devices and families, including Snapdragon Auto, Snapdragon Consumer Elect...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

CVE-2019-10604

CVE-2019-10604 describes a heap-buffer-overflow in Snapdragon’s diag command response handling where the last loop iteration on populating image version information can overflow a heap buffer. Affected platforms span numerous Snapdragon Auto/IoT devices (APQ8053, APQ8096AU, APQ8098, MDM9607, …, S...

CVE-2019-10609

CVE-2019-10609 affects Qualcomm closed‑source components with an out‑of‑bounds write caused by insufficient array index checks during calculation. Publicly listed in Red Hat and NVD records as a critical issue affecting numerous Qualcomm/Snapdragon subcomponents (e.g., APQ/SDM series). Root cause...

CVE-2019-14081

CVE-2019-14081 describes a buffer over-read in the WLAN module when handling a WMI message for SAR limits with an invalid number of limits. Affected products include Snapdragon family components (Compute/Consumer Connectivity/IoT lines and related APQ/IPQ/SDM/QCA/QCN/SDA devices). The root cause ...

CVE-2019-14083

CVE-2019-14083 is a Qualcomm/Snapdragon vulnerability where parsing the Service Descriptor Extended Attribute in SDF frames can misinterpret the attribute length, causing an integer underflow. Affected: Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Indus...

CVE-2019-14095

CVE-2019-14095 describes a buffer overflow in Snapdragon devices during LMP packet processing when the Bluetooth name length exceeds the BT specification. Affected families include Snapdragon Auto, Compute, Connectivity, and related Snapdragon devices across numerous SoCs (APQ8009, SDM… etc.). Th...

CVE-2019-14101

CVE-2019-14101 affects Qualcomm Snapdragon platforms (e.g., Auto, Compute, Connectivity, IOT, Mobile, Wearables) including APQ8009/8096 families and many MSM/SDM/QCS/SXR devices. The vulnerability is an out-of-bounds read in the diag event set mask command handler when the provided length in the ...

CVE-2019-2236

CVE-2019-2236 is a null pointer dereference during secure application termination when using specific application IDs. Affected vendors/products (as listed in the description) include Qualcomm Snapdragon families and multiple Snapdragon platforms (e.g., IPQ8074, MDM9xxx, SD 4xx–430/625/820, 8CX, ...

CVE-2019-2253

CVE-2019-2253 is a buffer over-read that can occur when parsing a corrupted OGG comment block in Qualcomm Snapdragon devices (listed families). The root cause is parsing a stream with malformed metadata leading to reading beyond bounds. The description and connected documents do not provide expli...

CVE-2019-2271

CVE-2019-2271 is a buffer over-read in Qualcomm closed-source components used across Snapdragon lineups (e.g., APQ8009/8017/8053/8096A U, SDM/SM/SC families). It can occur when parsing downlink OTA messages with unintended network values, potentially enabling remote code execution or other impact...

CVE-2019-2283

An out‑of‑bounds access vulnerability in Qualcomm Snapdragon devices results from improper validation of the read/write index of TX/RX FIFOs before pointer calculation. The issue affects a broad set of Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Weara...

CVE-2019-2305

CVE-2019-2305 corresponds to an out-of-bounds access in processing where the reason code is extracted from frame data without validating the frame length. Affected are Snapdragon platforms across multiple product families (Snapdragon Auto, Consumer Electronics Connectivity, Consumer IoT, Industri...

CVE-2019-2328

CVE-2019-2328 describes a potential buffer overflow when the number of channels exceeds the size of the channel mapping array in Qualcomm/ Snapdragon audio-related components (across multiple Snapdragon families). The vulnerability is listed under Qualcomm Audio in the 2019 Android security conte...

CVE-2019-2330

CVE-2019-2330 describes an issue with improper input validation in the allocation request for secure allocations, which can lead to a page fault on Qualcomm hardware. Affected products span multiple Qualcomm platforms (e.g., Snapdragon Auto/Compute/Mobile/IoT, IPQ4019/IPQ8064/IPQ8074, MDM9xxx, SD...

CVE-2019-2332

CVE-2019-2332 : A memory corruption issue in Qualcomm Snapdragon families (numerous SDMs/SDX/SDA/SM models) arises when payload size is not validated before memory access. CVSSv3.1 base score 9.8 (CRITICAL; Network, Low, None) per NVD; exploitation could occur remotely without user interaction. C...

CVE-2020-11168

CVE-2020-11168 is a null-pointer dereference vulnerability affecting a broad list of Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Wearables) across numerous SoCs (APQ8xxx, SDM/SXR families, etc.). The underlying flaw is a null-pointer dereferen...

CVE-2017-18310

CVE-2017-18310 affects Qualcomm closed‑source components in Snapdragon devices, with the issue described as a code injection vulnerability involving ClientEnv exposing services 0–32 to the HLOS. The associated records (NVD/NIST, CVE list, prion entry) indicate local attack feasibility and a high/...

CVE-2017-18320

CVE-2017-18320 describes a data abort in QSEE when unloading on a third-party TEE without prior loading, affecting Qualcomm Snapdragon automotive/mobile platforms across numerous SoCs (e.g., MSM8996AU, SD 410/12, 820, 835, 650/52, 710/670, 810, 820A, 835, 660, several SDM/SXR variants). The linke...

CVE-2018-11821

CVE-2018-11821 concerns a possible integer overflow during memory allocation in Qualcomm WLAN components across Snapdragon mobile/wear platforms (IPQ8074, MDM9206, MDM9607, MDM9650, SD 4xx/6xx/8xx series, SDA660, SDM630/632/636/660/710, Snapdragon_High_Med_2016). Root cause: integer overflow in W...

CVE-2018-11871

The CVE-2018-11871 entry describes a buffer overwrite in the WLAN function when processing the set pdev parameter, caused by insufficient input validation in Qualcomm Snapdragon components (Snapdragon Automobile/Mobile/Wear) across a long list of IPQ/SDM/QCA platforms (e.g., IPQ4019, IPQ8064, IPQ...

CVE-2018-11921

The CVE-2018-11921 entry concerns a failure-condition handling defect that fails to return the correct error code. Affects Snapdragon family components across numerous SoCs (e.g., MDM9206, MDM9607, MDM9650, MSM8996AU, SD/SDX-series, SDA-series, SXR1130) and can cause unintended SUI behavior or di...

CVE-2018-11970

CVE-2018-11970 affects Qualcomm Snapdragon platforms (Auto/Compute/CE Connectivity/IOT/Industrial IOT/Mobile including MDM9xxx, QCS605, SD family) where TZ App dynamic allocations are not protected from the XBL loader. Root cause per CVE notes is unprotected dynamic allocations in the TZ app with...

CVE-2018-13913

CVE-2018-13913 describes an unauthorized access vulnerability caused by improper validation of an array index while processing debugFS in Qualcomm Snapdragon components. The CNVD entry (CNVD-2019-05662) specifies this vulnerability as affecting multiple Qualcomm products and variants, including M...

CVE-2018-5918

CVE-2018-5918 describes a possible buffer overflow in the DRM Trusted application on Qualcomm Snapdragon platforms (e.g., MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD family up to SDX24 and SXR1130, including SD410/12, SD425, SD430, SD450, SD615/16/SD415, SD625, SD650/52, SD800, SD810, SD82...

CVE-2019-10489

CVE-2019-10489 involves a possible null-pointer dereference when parsing an AVI clip during copy in Qualcomm Snapdragon drivers across many Snapdragon products. Root cause: null pointer in parsing/copy path. Impact: high, with potential crash (availability) and no confidentiality/integrity impact...

CVE-2019-10524

CVE-2019-10524 involves a lack of validation for a negative value returned by get_clk, which is misinterpreted as a valid pointer, causing a use-after-free in the Qualcomm clk driver across numerous Snapdragon platforms (e.g., Snapdragon Auto/Mobile/IoT variants). The issue enables local exploita...

CVE-2019-14037

CVE-2019-14037 is a Use-After-Free vulnerability arising from close and bind operations on sockets in several Qualcomm/Snapdragon kernels. Connected sources (NVD, Red Hat, CVE list, PRION, ENISA EUVD, and Android Pixel bulletin) confirm the issue affects a wide range of Snapdragon/SoC families (e...

CVE-2019-14039

CVE-2019-14039 is an out-of-bounds read in the Qualcomm Snapdragon hardware/firmware stack. The issue arises from an incorrect boundary check in the ADM callback function when processing payloads in command responses, affecting multiple Snapdragon families (Auto, Compute, Consumer IoT, Industrial...

CVE-2019-14094

CVE-2019-14094 describes an integer overflow in the diag command handler when a large value is supplied for the number of tasks in request packets. Affected products are Qualcomm Snapdragon families including Snapdragon Auto, Compute, Connectivity, etc., across numerous SoCs (e.g., APQ8009, APQ80...

CVE-2019-2285

CVE-2019-2285 describes an out-of-bounds write bug in Qualcomm Snapdragon media handling related to reporting properties during video playback. Affected are Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables platforms across numerous SDM/SD vari...

CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...

CVE-2019-2315

CVE-2019-2315 concerns a data handling issue in Snapdragon SoCs where parameters populated during a copy operation from a non-secure environment to a secure buffer can be exposed or mishandled. The description consistently cites copying from an fd or local buffer to a secure buffer with inputs fr...

CVE-2020-3658

CVE-2020-3658 involves a possible null-pointer dereference in the MP4 parsing path for Snapdragon media components. Affected are Qualcomm/Android platforms using Snapdragon Auto, Compute, Connectivity, IOT, Mobile, Wearables, and related SoCs (e.g., APQ8009, SDM, SM families) per multiple vendor ...

CVE-2017-18323

CVE-2017-18323 involves cryptographic key material leakage in TDSCDMA RRC debug messages affecting Qualcomm Snapdragon components across multiple platforms (e.g., MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU) and various SD/SoC families (e.g., SD 21...

CVE-2018-11268

CVE-2018-11268 describes a potential buffer overflow in Snapdragon/Qualcomm components when parsing TFTP options on a wide range of SoCs (e.g., MDM9206/9607/9635M/9640/.../SD 810–845). The connected documents confirm affected Snapdragon/Qualcomm closed‑source components; however, the exact root c...

CVE-2018-11279

CVE-2018-11279 describes a buffer overflow caused by lack of input size checking in Qualcomm Snapdragon components for automotive, mobile, and wearables. Affected families include a long list of Qualcomm/SDM/SD variations (e.g., MDM9206, MDM9607, SD 210/212/205, SD 410/12, SD 625, SD 835, SD 845/...

CVE-2018-11996

CVE-2018-11996 describes an out-of-bounds access in the Qualcomm device programmer when a malformed command is sent, affecting Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear platforms (versions including MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, ...

CVE-2019-10488

CVE-2019-10488 describes a Null pointer dereference in the Qualcomm Snapdragon media parsing when handling nonstandard clips; the issue affects a broad range of Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.) across many SD/SoC families listed in the description. Root cause is ...

CVE-2019-13995

CVE-2019-13995 describes a lack of integer overflow protection when adding fragment size to remaining size read from shared memory, causing memory corruption and potential information leakage in Qualcomm Snapdragon components. Affected products span numerous Snapdragon generations (APQ, IPQ, QCS ...

CVE-2019-14033

CVE-2019-14033 involves multiple Read overflows due to an improper length check when decoding tau reject/accept and detach/attach requests in Qualcomm Snapdragon components across numerous devices. The issue affects Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Wearables (listing man...

CVE-2019-2251

CVE-2019-2251 describes a stack-buffer overflow when a bitmap is loaded from an unauthenticated source, affecting Qualcomm/SoC families listed in the initial records (e.g., Snapdragon Auto/Compute/Connectivity and related devices). The vulnerability is tied to closed-source Qualcomm components an...

CVE-2019-2294

CVE-2019-2294 relates to a vulnerability in Qualcomm Snapdragon components where a hard-coded magic number is used to calculate heap guard bytes. This can allow an attacker to corrupt heap blocks without understanding the heap’s algorithm, affecting a wide range of Snapdragon-based products (Auto...

CVE-2019-2310

CVE-2019-2310 describes an out-of-bounds read when parsing the Rx Frame body (action category and action ID) in Qualcomm Snapdragon components (including Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile, Snapdrago...

CVE-2019-2327

CVE-2019-2327 describes a possible buffer overflow when playing a clip with an incorrect element size affecting a wide range of Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and related SDM/SD/ Snapdragon families). T...

CVE-2020-11207

CVE-2020-11207 is a buffer overflow in the LibFastCV library due to improper size checks, affecting Qualcomm Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, and Mobile products (APQ8052 through SA8195P and related SKUs). The root cause is inadequate validation of buffer lengths in LibFast...