CVE-2021-1905

CVE-2021-1905 is a memory-management vulnerability (use-after-free) in Qualcomm Snapdragon chipsets caused by improper handling of memory mapping across multiple processes. Affects a broad range of Snapdragon products (Auto, Compute, Connectivity, IoT, Mobile, Wearables, etc.). The CVE is charact...

CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2021-1931

CVE-2021-1931 is a buffer overflow in Qualcomm SDM660 bootloader processing of fastboot/flash data. The exploit arose from improper handling of large payloads in the bootloader’s flash: command, enabling memory corruption that could bypass signature checks and unlock the bootloader on SDM660 devi...

CVE-2020-11239

CVE-2020-11239 describes a use-after-free when importing a DMA buffer using the CPU address due to an attachment not being cleaned up. Affected are Qualcomm/Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables). The root caus...

CVE-2020-11240

CVE-2020-11240 describes a memory corruption issue in Qualcomm Snapdragon components triggered by an ioctl command with an incorrect copy size. The vulnerability affects a broad set of Snapdragon products (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables...

CVE-2020-11290

CVE-2020-11290 is a use-after-free in Qualcomm MSM ioctl event handling caused by a race between ioctl register and deregister. Affected are Snapdragon products including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Wearables. The issue stems from contention in the ioctl...

CVE-2021-1955

CVE-2021-1955 describes a Denial of Service in Qualcomm’s Snapdragon stack caused by improper handling of connections when an association is rejected. The issue affects Snapdragon Auto/Compute/Connectivity and related Snapdragon lines (IoT, Wearables, Mobile, etc.). Root cause: mishandling of con...

CVE-2020-11309

The CVE-2020-11309 issue is a Use-After-Free in Qualcomm Adreno GPU drivers related to mapping user memory to GPU memory, caused by an improper check of referenced memory in Snapdragon GPUs. The vulnerability affects Qualcomm GPU components integrated in Snapdragon devices (Auto/Compute/Connectiv...

CVE-2020-11262

CVE-2020-11262 describes a race between command submission and context destruction that can cause an invalid context to be added, leading to a use-after-free condition. Reported for Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables (Qualcomm/Snapdrago...

CVE-2020-11308

CVE-2020-11308 describes a buffer overflow in Qualcomm Snapdragon components (e.g., Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music and related bootloader) triggered while converting ASCII strings to Unicode when the actual size exceeds the required size. Pub...

CVE-2021-1976

CVE-2021-1976 is a Qualcomm WLAN use-after-free vulnerability caused by improper validation of a P2P device address in PD Request frames. It affects Qualcomm/ Snapdragon WLAN components; exploited via network, with a CVSS v3.1 base score of 9.8 (CRITICAL). Public details reference Qualcomm’s Augu...

CVE-2021-1972

CVE-2021-1972 is a Qualcomm WLAN host vulnerability described as a buffer overflow caused by improper validation of device types during P2P search in Snapdragon platforms (Auto/Compute/Connectivity/…/Wired Networking). Affected products are Qualcomm/Snapdragon WLAN components; CVSS v3.1 base scor...

CVE-2020-11301

CVE-2020-11301 describes improper authentication of unencrypted plaintext Wi‑Fi frames within encrypted networks, enabling information disclosure in Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & ...

CVE-2021-1927

CVE-2021-1927 describes a use-after-free in the Qualcomm FastRPC driver affecting Snapdragon devices (Auto, Compute, Connectivity, IoT, Mobile, Wearables, etc.). The root cause is a missing null check while memory is being freed, enabling a local attacker to trigger memory corruption with effects...

CVE-2021-30259

CVE-2021-30259 affects Qualcomm Snapdragon platforms (Auto/Compute/Connectivity, Consumer IoT, Industrial IoT, Mobile, Wearables, etc.) with a likely closed-source component vulnerability caused by improper validation of function table entries, leading to possible out-of-bounds access. The issue ...

CVE-2021-1939

CVE-2021-1939 affects Qualcomm Snapdragon components (Auto/Compute/Connectivity/IoT/Wearables families) with a null pointer dereference caused by improper validation when preemption feature enablement is toggled. Root cause: validation flaw leading to dereference of a null pointer in affected pre...

CVE-2021-1947

CVE-2021-1947 is a use-after-free in the kernel graphics driver caused by storing an invalid pointer inside Qualcomm Snapdragon components (Snapdragon Compute, Connectivity, Industrial IoT, Mobile, Wearables, Wired Infrastructure and Networking). The entry indicates a local, low-effort attack pat...

CVE-2021-1904

CVE-2021-1904 is an information-disclosure issue arising in Qualcomm Snapdragon components where a child process may leak information from its parent due to numeric PIDs being compared and potentially reused. The CVE entry references Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial Io...

CVE-2020-11267

CVE-2020-11267 involves a stack out-of-bounds write during the setup of a cipher device when the IV length exceeds the maximum limit on Qualcomm/Snapdragon devices (Auto/Compute/Connectivity/Consumer IoT/Industrial IOT/Mobile/Voice & Music/Wearables/Wired Infrastructure). The vulnerability affect...

CVE-2020-11234

CVE-2020-11234 describes a Use-After-Free condition in Qualcomm Snapdragon family firmware: when sending a socket event message to a user application, invalid information can be passed if the socket is freed by another thread, leading to a local impact on Snapdragon Auto, Snapdragon Compute, Snap...

CVE-2020-11296

CVE-2020-11296 concerns an arithmetic overflow in processing NOA IE across multiple Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, etc.). Root cause is improper error handling, leading to an overflow that can impact Snapdragon families including Mobile, IoT, Automotive lines and rela...

CVE-2020-11170

CVE-2020-11170 involves an out-of-bounds memory access during Vorbis audio playback due to improper header extraction checks in Qualcomm/ Snapdragon components (Auto, Compute, Connectivity, IOT, Mobile, etc.). Root cause: insufficient validation in header parsing leads to memory access beyond bou...

CVE-2020-11178

CVE-2020-11178 affects Qualcomm Snapdragon automotive/IoT platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wired Infrastructure & Networking). The issue arises when trusted apps overwrite CPZ memory because the TrustZone (TZ) logic only check...

CVE-2021-30327

CVE-2021-30327 describes a buffer overflow in the Sahara protocol during command processing that overwrites secure configuration data in Qualcomm Snapdragon products. Affected are Snapdragon Mobile, Compute, Auto, IOT, Connectivity, and Voice & Music lines. Root cause: buffer overflow in Sahara p...

CVE-2020-11159

CVE-2020-11159 is a buffer over-read in Snapdragon/Qualcomm code while processing WPA/RSN IE in beacon and response frames. The flaw occurs when the IE length is shorter than the frame pointer being accessed, potentially affecting multiple Snapdragon product families (Auto, Compute, Connectivity,...

CVE-2020-11299

CVE-2020-11299 describes a buffer overflow in Qualcomm closed‑source components used in Snapdragon software stacks (Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables). The root cause is a buffer overflow while decoding a non‑standard video clip, which can be tri...

CVE-2020-11228

CVE-2020-11228 affects Qualcomm closed‑source components (on Snapdragon platforms) due to an improper policy in the RPM region of xblSec, enabling unprivileged access. The issue is documented across multiple sources (NVD entry and Red Hat advisory) with explicit references to Qualcomm’s security ...

CVE-2020-11275

CVE-2020-11275 involves a possible buffer over-read when parsing a quiet Information Element in an Rx beacon frame on Qualcomm Snapdragon platforms (Auto/Compute/Connectivity, Consumer Electronics Connectivity, IoT, Industrial IoT, Mobile, etc.). The root cause is an improper check of the IE leng...

CVE-2021-1953

CVE-2021-1953 is a Qualcomm/Snapdragon chipset vulnerability: improper handling of malformed FTMR request frames can cause a reachable assertion when replying with FTM1 frames, enabling a network‑based DoS against multiple Snapdragon Product families (Auto, Compute, Connectivity, etc.). The CVSS3...

CVE-2020-11126

CVE-2020-11126 affects Qualcomm closed‑source components in Snapdragon lineups, tied to WLAN frame parsing. The root cause is an out-of-bounds read caused by missing checks for body and header lengths in parsing WLAN frames across multiple Snapdragon families (Auto, Compute, Connectivity, Consume...

CVE-2020-11238

CVE-2020-11238 is a buffer over-read in ARP/NS parsing caused by a missing length check on received packets, affecting Qualcomm Snapdragon-based platforms across multiple product families (Auto, Compute, Connectivity, CES, IoT, Industrial IoT, Mobile, V&M, and Wired Networking). The impact is a p...

CVE-2020-11269

CVE-2020-11269 is a memory corruption issue described as occurring while processing EAPOL frames due to insufficient validation of key length in Qualcomm Snapdragon families (Auto, Compute, Connectivity, and related Snapdragon components). The initial entry lists a high severity (CVSS v3.1 base 8...

CVE-2020-11278

CVE-2020-11278 affects Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, CE Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wired Infrastructure & Networking). The root cause is improper validation when handling host WMI commands, leading to possible Denial...

CVE-2020-11280

Summary : CVE-2020-11280 describes a DoS vulnerability in Qualcomm/ Snapdragon components due to improper error handling when processing a Fine Timing Measurement (FTMR) frame with reserved bits in the FTM parameter IE. Affected products/areas : Snapdragon Auto, Snapdragon Compute, Snapdragon Con...

CVE-2020-11203

CVE-2020-11203 describes a stack overflow in Qualcomm/Snapdragon components triggered when a GSM/WCDMA broadcast config size received from user exceeds the size of a variable-length array. Affected products include Snapdragon Auto, Connectivity, and various IoT/Wearable families. Impact per CVSS ...

CVE-2020-11270

CVE-2020-11270 : A DoS condition in Qualcomm Snapdragon firmware (across Snapdragon Auto, Compute, Connectivity, and related Snapdragon platforms) arises when an RTT responder consistently rejects all FTMR by sending FTM1 with a failure status in the FTM parameter IE. This vulnerability is descri...

CVE-2020-11182

CVE-2020-11182: Affects Snapdragon/Qualcomm components where a heap overflow can occur while parsing the NAL header due to missing length validation of user-supplied data. Description explicitly lists Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, and Mobile as impacted. Ro...

CVE-2020-11220

CVE-2020-11220 is a TOCTOU-type issue in processing storage SCM commands where a pointer could be invalid during a specific window in Qualcomm closed-source components used in Snapdragon Auto/Compute/Connectivity/Industrial IOT/Mobile/Wired platforms. The connected documentation confirms the vuln...

CVE-2020-11241

CVE-2020-11241 affects Qualcomm Snapdragon family components (e.g., Snapdragon Auto, Compute, Connectivity, and related Snapdragon lines) and is rooted in the NAN shared key descriptor processing when EAPOL Key length is shorter than expected. The vulnerability exposes an out-of-bounds read in th...

CVE-2021-1938

CVE-2021-1938 concerns a Qualcomm/Snapdragon issue involving an assertion caused by improper verification when creating and deleting a peer across multiple Snapdragon subsystems (Auto, Compute, Connectivity, etc.). The root cause is described as improper verification during peer creation/deletion...

CVE-2020-11235

CVE-2020-11235 describes a buffer overflow that can occur while parsing a unified command due to insufficient input validation in Qualcomm Snapdragon components (Auto, Compute, Connectivity, etc.). The issue is triggered locally and can impact confidentiality, integrity, and availability, as indi...

CVE-2020-11276

CVE-2020-11276 is a buffer over-read in processing P2P IE and NOA attributes in beacon/probe frames due to improper validation of P2P IE/NOA lengths in Qualcomm Snapdragon firmware (across Snapdragon Auto, Compute, Connectivity, and related Snapdragon lines). Root cause is incorrect length valida...

CVE-2020-11195

CVE-2020-11195 concerns an out-of-bounds read/write in the Trust Authority (TA) when processing commands from the NS side, caused by an improper length check on command and response buffers. Affected are Snapdragon platforms including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mob...

CVE-2020-11165

CVE-2020-11165 : Memory corruption due to a buffer overflow when copying the HLOS message into a buffer without validating its length. Affects Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Wired Infrastructure and Networking). Root ca...

CVE-2020-11307

CVE-2020-11307 describes a buffer overflow in Qualcomm’s modem stack due to an improper array index check when copying into a buffer in multiple Snapdragon family components (Auto, Compute, Connectivity, CIoT, Industrial IoT, Wearables). The root cause is an input/length handling issue that can l...

CVE-2020-3664

The CVE-2020-3664 entry refers to an out-of-bounds read in the hypervisor caused by invalid read accesses when passing incorrect addresses in various Snapdragon components (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wired Infrastructure and Networking). Affe...

CVE-2020-11119

CVE-2020-11119 describes a buffer over-read in Snapdragon components (Auto/Compute/Connectivity/IoT/Industrial IoT, etc.) where a mismatch between the buffer length from response handlers and the payload size can trigger over-read. Affected are Qualcomm Snapdragon platforms as listed; root cause ...

CVE-2020-11204

CVE-2020-11204 affects Qualcomm closed‑source components within Snapdragon Auto/Compute/Connectivity/IoT families. The root cause is a lack of validation and boundary checks for parameters read from shared MSG RAM in multiple sub-systems, causing potential memory corruption and information leakag...

CVE-2021-1924

CVE-2021-1924 is an information-disclosure vulnerability arising from timing and power-side channels during RSA-CRT mod exponentiation in Qualcomm/Snapdragon closed-source components (notably in Snapdragon Auto/Compute/Connectivity families). The issue is described across multiple sources, includ...