CVE-2019-10490

CVE-2019-10490 describes a use-after-free in the Xtra daemon shutdown caused by a static object instance being freed from multiple places in Qualcomm-based Snapdragon platforms (including Snapdragon Auto/Compute/Connectivity, IoT, wearables, and various SoCs). The issue affects a wide range of Qu...

CVE-2019-10496

CVE-2019-10496 involves a lack of checking a variable received from a driver when populating a Firmware data structure, causing a buffer overflow. Affects Qualcomm Snapdragon families including Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables and a b...

CVE-2019-10503

CVE-2019-10503 describes an out-of-bounds access in the Qualcomm Snapdragon camera driver caused by improper validation of an array index across multiple Snapdragon platforms (APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9…, SDM660, SDX20, etc.). Root cause: insufficient validation leading t...

CVE-2019-10592

CVE-2019-10592 describes a possible 32-bit integer overflow in the QDCM API function get display modes on Qualcomm Snapdragon platforms (covering Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Wearables families and SKUs listed). The root cause is a missing check on the maximum mode c...

CVE-2019-14026

CVE-2019-14026 describes a possible buffer overflow in the WLAN WMI handler caused by missing SSID length checks during data copy on Qualcomm Snapdragon platforms (e.g., APQ80xx, SDM/SM series, QCA devices, and others listed). Root cause: insufficient length validation for SSID data before copyin...

CVE-2019-14031

CVE-2019-14031 describes a buffer overflow in Qualcomm Snapdragon devices when parsing RSN Information Elements that contain a list of PMK IDs longer than the allocated buffer. The issue affects a broad set of Snapdragon products (Auto, Compute, Connectivity, IoT, Mobile, etc.) across numerous So...

CVE-2019-14112

The CVE-2019-14112 entry describes a potential buffer overflow when processing CBF frames due to a missing buffer-length check before copy in Qualcomm Snapdragon components. Affected products span Snapdragon Auto, Compute, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Mobile, a...

CVE-2019-2249

CVE-2019-2249 affects Qualcomm Snapdragon kernel code and enables a memory read from an arbitrary address supplied by user during a syscall. Documented in multiple sources (NVD, Red Hat), it lists extensive Snapdragon family coverage (e.g., IPQ8074, SD 427/435/450/625/636/665/675/712/710/670/730/...

CVE-2019-2300

CVE-2019-2300 describes a possible buffer overflow in the WLAN handler due to missing validation of the destination buffer size when copying data, affecting a wide range of Qualcomm Snapdragon SoCs (APQ8009, APQ8017, APQ8053, APQ8096, APQ8098, IPQ8074, MDM92xx, MSM89xx, QCA formats, SDM/SM varian...

CVE-2019-2325

CVE-2019-2325 affects a wide range of Qualcomm Snapdragon components (Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/IoT/Mobile/Voice & Music/Wearables) across multiple platforms (MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, and various SD/SDM/SDA/SDX ser...

CVE-2019-2335

CVE-2019-2335 concerns a logic issue in Qualcomm Snapdragon firmware where, while processing an Attach Reject message, the valid exit condition is not met, causing an infinite loop. Affected are numerous Snapdragon platforms (e.g., APQ8009/8017/8053/8096AU/8098, MDM9xxx, SDX20, SDX55, SM6x50 seri...

CVE-2020-11207

CVE-2020-11207 is a buffer overflow in the LibFastCV library due to improper size checks, affecting Qualcomm Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, and Mobile products (APQ8052 through SA8195P and related SKUs). The root cause is inadequate validation of buffer lengths in LibFast...

CVE-2020-3621

CVE-2020-3621: A lack of checks ensures that the TX read index and RX write index read from shared memory are less than the FIFO size, causing memory corruption and potential information leakage in Snapdragon devices (numerous SoCs and families listed). The available documents describe the root c...

CVE-2020-3661

CVE-2020-3661 is a buffer overflow in Qualcomm Snapdragon components occurring when parsing MP4 clips with corrupted sample atoms values exceeding MAX_UINT32, caused by missing input validation. Affected products span Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, W...

CVE-2017-18331

CVE-2017-18331 affects Qualcomm Snapdragon devices with affected secure display buffers (mobile, automobile, wearables) and is due to an improper access control in the buffer handling. Affected products/SoCs include versions of MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/212/205, SD 820, SD 820A...

CVE-2018-11285

CVE-2018-11285 describes a buffer over-read in Snapdragon SoCs when parsing FLAC files with a corrupted picture block. Affected products include a wide range of Qualcomm/SDM/SD platforms (e.g., MDM9206, SD 210–P, SD 820/835/845, SDX20, Snapdragon_High_Med_2016, etc.). The root cause is a buffer o...

CVE-2018-11931

CVE-2018-11931 is listed in the Qualcomm closed-source components section of the 2019 Android security bulletin. The vulnerability is described as improper access to HLOS when transferring memory to CPZ in multiple Snapdragon/SOC families (e.g., MDM/SD series and Snapdragon channels). The CVSS da...

CVE-2018-11970

CVE-2018-11970 affects Qualcomm Snapdragon platforms (Auto/Compute/CE Connectivity/IOT/Industrial IOT/Mobile including MDM9xxx, QCS605, SD family) where TZ App dynamic allocations are not protected from the XBL loader. Root cause per CVE notes is unprotected dynamic allocations in the TZ app with...

CVE-2018-13897

CVE-2018-13897 affects Snapdragon devices running dnsmasq, where a hostname is added to the device’s DNS records, causing information exposure (confidentiality impact). Affected families include Snapdragon Auto, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Wearables across numerous SD...

CVE-2018-5879

CVE-2018-5879 affects Snapdragon mobile and Snapdragon Wear platforms (list includes MDM9206, MDM9607, SD 210/212/205, 425, 427, 430, 435, 450, 625, 636, 835, SDA660, SDM630, SDM660). Root cause is an improper length check while processing an MQTT message, which can lead to a heap overflow. The i...

CVE-2018-5914

CVE-2018-5914 involves improper input validation in the TZ component, causing an array out-of-bounds in TZ when accessing peripheral details from incoming data. Affected are Snapdragon Mobile and Snapdragon Wear platforms, including versions MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 425, SD 4...

CVE-2019-10495

CVE-2019-10495 describes an arbitrary buffer write during processing of sequence headers for HEVC/AVC encoding in Qualcomm Snapdragon SoCs (wide range of Snapdragon Auto/Compute/Connectivity/IoT devices). The vulnerability is caused by a buffer-write flaw in the encoder path; vulnerable component...

CVE-2019-10501

The CVE-2019-10501 entry affects Qualcomm Snapdragon volumes listener library across multiple Snapdragon platforms. Root cause: use-after-free caused by improper input validation in the volume listener component. Reported impact indicates partial confidentiality, integrity, and availability at a ...

CVE-2019-10524

CVE-2019-10524 involves a lack of validation for a negative value returned by get_clk, which is misinterpreted as a valid pointer, causing a use-after-free in the Qualcomm clk driver across numerous Snapdragon platforms (e.g., Snapdragon Auto/Mobile/IoT variants). The issue enables local exploita...

CVE-2019-14052

CVE-2019-14052 affects Qualcomm Snapdragon devices (Auto/Compute/Consumer IoT/Industrial IoT/ Mobile/ Wearables, etc.) across numerous SoCs (APQ8xxx, MDM*, MSM*, QCM/QCS, etc.). The issue arises from accessing an uninitialized data structure, which could cause partial copying of contents and lead...

CVE-2019-14093

CVE-2019-14093 affects Qualcomm Snapdragon display/graphics components across numerous Snapdragon variants. The root cause is an array bounds issue due to missing bound checks on input parcels in the display module. Impact is rated High (CVSSv3: HIGH for confidentiality, integrity, and availabili...

CVE-2019-14097

CVE-2019-14097 is a possible buffer overflow in Qualcomm/Qualcomm Snapdragon WLAN Parser due to a missing length check when copying data. Affected devices span many Snapdragon families (Auto, Compute, Connectivity, etc.). The issue is classified as critical (CVSS v3.1: 9.8) for network access wit...

CVE-2019-14115

CVE-2019-14115 affects Qualcomm Snapdragon platforms (listed APQ/SDM/SC families) where information disclosure could occur when secure touch is released without clearing the secure display session, potentially allowing a user to read secure input while touch is in a non-secure domain. Root cause:...

CVE-2019-2240

CVE-2019-2240 affects Qualcomm Snapdragon platforms (Auto/Compute/Connectivity, Snapdragon family across IPQ4xxx through SDX lines, QCA wireless ICs, etc.). Description: error handling during rendering of surface content to the screen is not properly checked, causing unpredictable behavior. Root ...

CVE-2019-2289

CVE-2019-2289 involves a lack of integrity check that allows a MODEM to accept arbitrary NAS messages, potentially causing authentication bypass of NAS on Snapdragon-based devices (e.g., Snapdragon Auto, Compute, IoT variants across APQ and MSM families). The description lists an extensive set of...

CVE-2019-2294

CVE-2019-2294 relates to a vulnerability in Qualcomm Snapdragon components where a hard-coded magic number is used to calculate heap guard bytes. This can allow an attacker to corrupt heap blocks without understanding the heap’s algorithm, affecting a wide range of Snapdragon-based products (Auto...

CVE-2019-2326

The CVE-2019-2326 issue affects a wide range of Qualcomm Snapdragon families. Data tokens from ADSP are used without validation as an index into an array, causing out-of-bounds access in components across Snapdragon Auto, Compute, Connectivity, IOT variants, Wearables, and related SDM/SDX platfor...

CVE-2019-2337

CVE-2019-2337 describes a buffer-read flaw in Qualcomm’s Snapdragon hardware/firmware where EMM may read beyond the declared message length while skipping unknown IES. The issue is linked to multiple Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables) and a long ...

CVE-2019-2343

The CVE-2019-2343 entry concerns out-of-bounds reads and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver within Qualcomm Snapdragon firmware across numerous SoCs and platforms (Snapdragon Auto, Compute, Connectivity, C...

CVE-2019-2346

CVE-2019-2346 affects Qualcomm Snapdragon family firmware (Snapdragon Compute, Snapdragon Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wired Infrastructure/Networking) impacting IPQ8074, QCA8081, QCS404/QCS405/QCS605 and various SD/SDM platforms. Description: a memory overwrite loop trigg...

CVE-2020-3644

CVE-2020-3644 documents identify an information-disclosure issue in Qualcomm Snapdragon platforms where a Secure Touch session is released without terminating the display session. Affected families include Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music...

CVE-2017-18282

CVE-2017-18282 concerns non-secure software enabling SDCC to generate secure bus accesses, potentially exposing RPM control on a range of Qualcomm Snapdragon platforms (Snapdragon Mobile/Wear) including devices with MDM9206, MDM9607, MDM9650 and SoCs/SD cards: SD 210/212/205, SD 425, 430, 450, 62...

CVE-2017-18294

CVE-2017-18294 describes a buffer overread when reading the ELF header file class type on Qualcomm closed‑source components (e.g., SoCs in Snapdragon/SD lines). The root cause is a size check mismatch where the ELF file size is less than the ELF64 header, potentially enabling local code execution...

CVE-2017-18299

CVE-2017-18299 affects Qualcomm closed‑source components in Snapdragon platforms (Automobile, Mobile, Wear) across several SoCs/SDs. The issue arises from improper translation table consolidation logic, causing resource exhaustion and QSEE errors. Connected records identify this CVE as associated...

CVE-2017-18326

CVE-2017-18326 affects Qualcomm Snapdragon mobile and Snapdragon Wear modem components (e.g., MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 800, ...

CVE-2017-8276

CVE-2017-8276 describes improper authorization involving a fuse in TrustZone affecting Qualcomm Snapdragon automotive, mobile, and wear platforms. Documented affected families include MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439/SD 429, SD 4...

CVE-2018-11267

Technical details about CVE-2018-11267 are not publicly available in the provided connected documents. The entry lists affected Qualcomm/SD components but does not specify root cause, vulnerable versions, impact specifics, or remediation. Monitor for updates.

CVE-2018-11882

CVE-2018-11882 concerns a vulnerability in the WLAN controller of Qualcomm Snapdragon Mobile on the SD 835/845/850 and SDA660 families. The root cause is an incorrect bound check that can lead to a potential buffer overwrite. The connected documents confirm the affected hardware/SoCs and the gene...

CVE-2018-3595

CVE-2018-3595 affects Qualcomm Snapdragon platforms (automobile/mobile/wear) across multiple SoCs (e.g., MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/212/205, 425, 430, 450, 625, 650/52, 712/710/670, 820/820A, 835/845/850, 660, SDX24, SXR1130). The vulnerability arises from improper error handlin...

CVE-2018-5880

The CVE-2018-5880 entry affects Qualcomm Snapdragon devices (mobile and wear) across multiple chips (e.g., MDM9206, MDM9607, SD 210/212/205, 425, 427, 430, 435, 450, 625, 636, 835, SDA660, SDM630, SDM660). The vulnerability stems from an improper data length check when processing an event report ...

CVE-2019-10626

CVE-2019-10626 describes a memory-read issue in Qualcomm/Snapdragon components where payload size is not validated before reading memory, potentially causing access to an invalid pointer or garbage data across a wide range of Snapdragon platforms (APQ8009, SDM7x, QCS, etc.). The root cause is rea...

CVE-2019-14022

CVE-2019-14022 concerns an error in parsing ipv6_header length due to a missing length check in Qualcomm/Snapdragon components (Auto, Compute, IOT, Wearables, Mobile, etc.). Affected family includes Snapdragon platforms (APQ, SDM/SM series, Nicobar, etc.) across numerous devices. Root cause: insu...

CVE-2019-2241

CVE-2019-2241 affects Qualcomm Snapdragon firmware across numerous Snapdragon Auto, Compute, Connectivity, and IoT platforms (e.g., MDM9150/MDM9607/SDX24/SD 210–SD 855 family). The root cause is improper error status checks and incorrect status handling during layout background rendering, leading...

CVE-2019-2252

CVE-2019-2252 is a classic buffer overflow in the Qualcomm Snapdragon video decode path triggered by decoding a specific video whose Decode picture buffer size exceeds 16. Described across Snapdragon Auto/Compute/Connectivity/IoT/Sensors/Wearables families (SDM/SDx/Snapdragon_High_Med_2016, SXR11...

CVE-2019-2254

CVE-2019-2254 affects Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/IoT/Mobile lines, including various SD/SDM/RH-series) where position-determination accuracy can be degraded due to wrongly decoded information. The root cause is not explicitly detailed beyond the decoding error...