CVE-2019-2334

CVE-2019-2334 is a null pointer dereference in Snapdragon media handling that can occur when playing a clip with a wrong block group id, affecting a broad set of Qualcomm Snapdragon products (Auto, Compute, IoT, Mobile, Wearables, etc.). The NVD and Red Hat entries rate it as HIGH severity with C...

CVE-2020-3684

CVE-2020-3684 describes a local, privilege-relevant issue in Qualcomm Snapdragon platforms where QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by the XBL Loader and applies them without validation. This affects a wide range of Snapdragon p...

CVE-2017-18124

CVE-2017-18124 : The description in the linked sources states that during secure boot an addition is performed on uint8 pointers, causing an overflow. This affects a broad set of Qualcomm/Snapdragon devices (e.g., FSM9055, IPQ4019, MDM9xxx, MSM/SDA/XOA families and many SD series SKUs). The conne...

CVE-2017-18302

CVE-2017-18302 affects Qualcomm Snapdragon SoCs (MSM8996AU and numerous SD/i variants listed) where a crafted HLOS client can modify in-memory structures passed to a QSEE application between check and use. This leads to arbitrary writes to TZ kernel memory regions, i.e., local elevation of privil...

CVE-2018-11949

CVE-2018-11949 describes a failure to initialize an extra buffer that can lead to an out-of-bounds access in the WLAN function of Qualcomm Snapdragon components (WLAN HOST) across multiple Snapdragon family devices. The affected scope includes Snapdragon Auto, Compute, Consumer IOT, Industrial IO...

CVE-2018-5837

The CVE-2018-5837 entry concerns Snapdragon SoCs (IPQ8074, MDM9xxx, SD series, etc.) where MAC address randomization during probe requests is compromised by a flawed RNG that outputs repeating values far sooner than expected. The description covers the affected devices and the root cause, but the...

CVE-2018-5867

CVE-2018-5867 relates to a buffer overflow caused by lack of input-size checking in WideVine on Qualcomm/Snapdragon platforms (automotive, mobile, wearables). Affected products include a broad list of Snapdragon/SDM/SDX devices (e.g., MDM9206, MDM9607, SD 210–SD 850 families, SDX24, Snapdragon_Hi...

CVE-2019-10489

CVE-2019-10489 involves a possible null-pointer dereference when parsing an AVI clip during copy in Qualcomm Snapdragon drivers across many Snapdragon products. Root cause: null pointer in parsing/copy path. Impact: high, with potential crash (availability) and no confidentiality/integrity impact...

CVE-2019-10509

CVE-2019-10509 is a use-after-free issue in the pairing device record that occurs after ACL disconnection on Qualcomm Snapdragon Bluetooth implementations. The description applies to Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables across ...

CVE-2019-10524

CVE-2019-10524 involves a lack of validation for a negative value returned by get_clk, which is misinterpreted as a valid pointer, causing a use-after-free in the Qualcomm clk driver across numerous Snapdragon platforms (e.g., Snapdragon Auto/Mobile/IoT variants). The issue enables local exploita...

CVE-2019-10555

CVE-2019-10555 is a buffer overflow affecting Qualcomm Snapdragon line devices (across Snapdragon Auto/Compute/Consumer Electronics Connectivity/IoT/Industrial IoT/Mobile/Wearables) via incorrect datatype usage and missing length checks when copying into buffers. Affected components are broadly i...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

CVE-2019-14039

CVE-2019-14039 is an out-of-bounds read in the Qualcomm Snapdragon hardware/firmware stack. The issue arises from an incorrect boundary check in the ADM callback function when processing payloads in command responses, affecting multiple Snapdragon families (Auto, Compute, Consumer IoT, Industrial...

CVE-2019-14080

CVE-2019-14080 is a high-severity, Qualcomm‑related vulnerability affecting Snapdragon modem data in multiple SoCs. Root cause: out-of-bounds write from lack of array index validation while parsing SDP attributes for SAR. Impact could be remote execution via network (per CVSS, network attack, cri...

CVE-2019-14095

CVE-2019-14095 describes a buffer overflow in Snapdragon devices during LMP packet processing when the Bluetooth name length exceeds the BT specification. Affected families include Snapdragon Auto, Compute, Connectivity, and related Snapdragon devices across numerous SoCs (APQ8009, SDM… etc.). Th...

CVE-2019-2253

CVE-2019-2253 is a buffer over-read that can occur when parsing a corrupted OGG comment block in Qualcomm Snapdragon devices (listed families). The root cause is parsing a stream with malformed metadata leading to reading beyond bounds. The description and connected documents do not provide expli...

CVE-2019-2288

CVE-2019-2288 is a reported out-of-bounds write in the TZ secure-dump path on Qualcomm Snapdragon platforms (multiple SoCs). The vulnerability occurs when copying a secure dump structure into a memory buffer provided by the HLOS, affecting a wide set of Snapdragon products. The NVD/NVD-derived me...

CVE-2020-3658

CVE-2020-3658 involves a possible null-pointer dereference in the MP4 parsing path for Snapdragon media components. Affected are Qualcomm/Android platforms using Snapdragon Auto, Compute, Connectivity, IOT, Mobile, Wearables, and related SoCs (e.g., APQ8009, SDM, SM families) per multiple vendor ...

CVE-2017-18310

CVE-2017-18310 affects Qualcomm closed‑source components in Snapdragon devices, with the issue described as a code injection vulnerability involving ClientEnv exposing services 0–32 to the HLOS. The associated records (NVD/NIST, CVE list, prion entry) indicate local attack feasibility and a high/...

CVE-2017-18330

CVE-2017-18330 describes a buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in Qualcomm Snapdragon-based platforms (automotive, mobile, wearables) across numerous SoCs and SD/SoC families. The issue affects components implementing AES-CCM/GCM and can impact confidential...

CVE-2018-11284

CVE-2018-11284 describes a vulnerability where spoofed SMS can trigger a flood of registration updates to the server on devices using Qualcomm Snapdragon mobile and Snapdragon Wear platforms (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20). The underlying...

CVE-2018-11821

CVE-2018-11821 concerns a possible integer overflow during memory allocation in Qualcomm WLAN components across Snapdragon mobile/wear platforms (IPQ8074, MDM9206, MDM9607, MDM9650, SD 4xx/6xx/8xx series, SDA660, SDM630/632/636/660/710, Snapdragon_High_Med_2016). Root cause: integer overflow in W...

CVE-2018-11931

CVE-2018-11931 is listed in the Qualcomm closed-source components section of the 2019 Android security bulletin. The vulnerability is described as improper access to HLOS when transferring memory to CPZ in multiple Snapdragon/SOC families (e.g., MDM/SD series and Snapdragon channels). The CVSS da...

CVE-2018-11935

CVE-2018-11935 affects Qualcomm Snapdragon devices (MDM9607/9650/9655, MSM8996AU, QCS605, SD 210–SD 415/SD 636/675/712 etc.) across Snapdragon Auto, Compute, Connectivity, and IoT lines. The issue is improper input validation in the Snapdragon stack that can cause an incorrect app id to be return...

CVE-2018-11996

CVE-2018-11996 describes an out-of-bounds access in the Qualcomm device programmer when a malformed command is sent, affecting Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear platforms (versions including MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, ...

CVE-2018-5914

CVE-2018-5914 involves improper input validation in the TZ component, causing an array out-of-bounds in TZ when accessing peripheral details from incoming data. Affected are Snapdragon Mobile and Snapdragon Wear platforms, including versions MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 425, SD 4...

CVE-2018-5918

CVE-2018-5918 describes a possible buffer overflow in the DRM Trusted application on Qualcomm Snapdragon platforms (e.g., MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD family up to SDX24 and SXR1130, including SD410/12, SD425, SD430, SD450, SD615/16/SD415, SD625, SD650/52, SD800, SD810, SD82...

CVE-2019-10587

CVE-2019-10587 describes a potential stack overflow when processing large or non-standard SDP bodies without proper delimiters in Qualcomm Snapdragon firmwares (multiple Snapdragon Auto/Compute/IoT/Wearables platforms listed). The entry notes a stack overflow vulnerability arising from SDP proces...

CVE-2019-10591

CVE-2019-10591 is a null pointer dereference that can occur while parsing a non-standard udta atom with invalid depth in Qualcomm/Snapdragon devices (including Snapdragon Auto, Compute, Connectivity, IoT, Wearables, etc.). The vulnerability affects a long list of Snapdragon-based platforms (APQ80...

CVE-2019-14026

CVE-2019-14026 describes a possible buffer overflow in the WLAN WMI handler caused by missing SSID length checks during data copy on Qualcomm Snapdragon platforms (e.g., APQ80xx, SDM/SM series, QCA devices, and others listed). Root cause: insufficient length validation for SSID data before copyin...

CVE-2019-14081

CVE-2019-14081 describes a buffer over-read in the WLAN module when handling a WMI message for SAR limits with an invalid number of limits. Affected products include Snapdragon family components (Compute/Consumer Connectivity/IoT lines and related APQ/IPQ/SDM/QCA/QCN/SDA devices). The root cause ...

CVE-2019-14094

CVE-2019-14094 describes an integer overflow in the diag command handler when a large value is supplied for the number of tasks in request packets. Affected products are Qualcomm Snapdragon families including Snapdragon Auto, Compute, Connectivity, etc., across numerous SoCs (e.g., APQ8009, APQ80...

CVE-2019-2236

CVE-2019-2236 is a null pointer dereference during secure application termination when using specific application IDs. Affected vendors/products (as listed in the description) include Qualcomm Snapdragon families and multiple Snapdragon platforms (e.g., IPQ8074, MDM9xxx, SD 4xx–430/625/820, 8CX, ...

CVE-2019-2239

CVE-2019-2239 is a Qualcomm/Snapdragon-related issue where sanity checks are missing in layout, potentially causing SUI corruption or denial of service. Affected families span Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms (e.g., MDM9150, SD 210/212/205, SD 410/12, SD 62...

CVE-2019-2328

CVE-2019-2328 describes a potential buffer overflow when the number of channels exceeds the size of the channel mapping array in Qualcomm/ Snapdragon audio-related components (across multiple Snapdragon families). The vulnerability is listed under Qualcomm Audio in the 2019 Android security conte...

CVE-2019-2341

CVE-2019-2341 describes a buffer overflow in the audio subsystem when a user-provided audio buffer size exceeds the maximum allowed. Affected: Snapdragon SoCs and families listed in the entry (e.g., Snapdragon Auto/Compute/IoT, Snapdragon Mobile, Wearables, etc.). Root cause: unchecked size in au...

CVE-2020-3661

CVE-2020-3661 is a buffer overflow in Qualcomm Snapdragon components occurring when parsing MP4 clips with corrupted sample atoms values exceeding MAX_UINT32, caused by missing input validation. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, W...

CVE-2018-11268

CVE-2018-11268 describes a potential buffer overflow in Snapdragon/Qualcomm components when parsing TFTP options on a wide range of SoCs (e.g., MDM9206/9607/9635M/9640/.../SD 810–845). The connected documents confirm affected Snapdragon/Qualcomm closed‑source components; however, the exact root c...

CVE-2018-11279

CVE-2018-11279 describes a buffer overflow caused by lack of input size checking in Qualcomm Snapdragon components for automotive, mobile, and wearables. Affected families include a long list of Qualcomm/SDM/SD variations (e.g., MDM9206, MDM9607, SD 210/212/205, SD 410/12, SD 625, SD 835, SD 845/...

CVE-2018-11866

The CVE-2018-11866 issue is an integer overflow in WLAN when calculating an internal structure size caused by lack of input-length validation in Snapdragon Mobile and Snapdragon Wear platforms (covering IPQ8074, MDM9206, MDM9607, MDM9650, SD 210/212/205, 425, 427, 430, 435, 450, 625, 835, 845, 85...

CVE-2018-13897

CVE-2018-13897 affects Snapdragon devices running dnsmasq, where a hostname is added to the device’s DNS records, causing information exposure (confidentiality impact). Affected families include Snapdragon Auto, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Wearables across numerous SD...

CVE-2018-13913

CVE-2018-13913 describes an unauthorized access vulnerability caused by improper validation of an array index while processing debugFS in Qualcomm Snapdragon components. The CNVD entry (CNVD-2019-05662) specifies this vulnerability as affecting multiple Qualcomm products and variants, including M...

CVE-2019-10503

CVE-2019-10503 describes an out-of-bounds access in the Qualcomm Snapdragon camera driver caused by improper validation of an array index across multiple Snapdragon platforms (APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9…, SDM660, SDX20, etc.). Root cause: insufficient validation leading t...

CVE-2019-14000

CVE-2019-14000 concerns memory corruption and potential information leakage in Qualcomm Snapdragon platforms due to a missing RX FIFO write index check against the FIFO size in shared RAM. Affected families include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Wear...

CVE-2019-14033

CVE-2019-14033 involves multiple Read overflows due to an improper length check when decoding tau reject/accept and detach/attach requests in Qualcomm Snapdragon components across numerous devices. The issue affects Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Wearables (listing man...

CVE-2019-2251

CVE-2019-2251 describes a stack-buffer overflow when a bitmap is loaded from an unauthenticated source, affecting Qualcomm/SoC families listed in the initial records (e.g., Snapdragon Auto/Compute/Connectivity and related devices). The vulnerability is tied to closed-source Qualcomm components an...

CVE-2019-2254

CVE-2019-2254 affects Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/IoT/Mobile lines, including various SD/SDM/RH-series) where position-determination accuracy can be degraded due to wrongly decoded information. The root cause is not explicitly detailed beyond the decoding error...

CVE-2019-2294

CVE-2019-2294 relates to a vulnerability in Qualcomm Snapdragon components where a hard-coded magic number is used to calculate heap guard bytes. This can allow an attacker to corrupt heap blocks without understanding the heap’s algorithm, affecting a wide range of Snapdragon-based products (Auto...

CVE-2019-2305

CVE-2019-2305 corresponds to an out-of-bounds access in processing where the reason code is extracted from frame data without validating the frame length. Affected are Snapdragon platforms across multiple product families (Snapdragon Auto, Consumer Electronics Connectivity, Consumer IoT, Industri...

CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...