ByteOS

Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Product

Versions

Affected

AQT1000, PM3003A, PM6150, PM7150A, PM7150L, PM7250, PM7250B, PM8004, PM8008, PM8009, PM8150, PM8150A, PM8150B, PM8150C, PM8150L, PM8250, PM855, PM855B, PM855L, PM855P, PMC1000H, PMK8002, PMK8003, PMM6155AU, PMM8155AU, PMM8195AU, PMM855AU, PMR525, PMR735B, PMX50, PMX55, QAT3516, QAT3518, QAT3519, QAT3555, QAT5515, QAT5522, QAT5533, QBT1500, QBT2000, QCA6390, QCA6391, QCA6420, QCA6421, QCA6426, QCA6430, QCA6431, QCA6436, QCA6574, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QDM2301, QDM2305, QDM3301, QDM5620, QDM5621, QDM5650, QDM5652, QDM5670, QDM5671, QDM5677, QDM5679, QET4101, QET5100, QET6110, QFS2530, QFS2580, QLN4642, QLN4650, QLN5020, QLN5030, QLN5040, QPA2625, QPA5580, QPA6560, QPA8673, QPA8686, QPA8801, QPA8802, QPA8803, QPA8821, QPA8842, QPM4650, QPM5620, QPM5621, QPM5657, QPM5658, QPM5670, QPM5677, QPM5679, QPM6582, QPM6585, QPM8820, QPM8830, QPM8895, QSM7250, QSM8250, QTC800H, QTC801S, QTM525, SA6145P, SA6150P, SA6155, SA6155P, SA8150P, SA8155, SA8155P, SA8195P, SC8180X+SDX55, SD 8C, SD ...[truncated*]

Problem Types

Type	CWE ID	Description
text	N/A	Use of Out-of-Range Pointer Offset Issue in ComputerVision

Type: text

CWE ID: N/A

Description: Use of Out-of-Range Pointer Offset Issue in ComputerVision

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin	x_refsource_CONFIRM

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin	x_refsource_CONFIRM x_transferred

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@qualcomm.com

Published At:21 Jan, 2021 | 10:15

Updated At:30 Jan, 2021 | 00:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.2

Base severity: HIGH

Vector:

AV:L/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*

>>aqt1000>>-

cpe:2.3:h:qualcomm:pm3003a:-:*:*:*:*:*:*:*

>>pm3003a>>-

cpe:2.3:h:qualcomm:pm6150:-:*:*:*:*:*:*:*

>>pm6150>>-

cpe:2.3:h:qualcomm:pm7150a:-:*:*:*:*:*:*:*

>>pm7150a>>-

cpe:2.3:h:qualcomm:pm7150l:-:*:*:*:*:*:*:*

>>pm7150l>>-

cpe:2.3:h:qualcomm:pm7250:-:*:*:*:*:*:*:*

>>pm7250>>-

cpe:2.3:h:qualcomm:pm7250b:-:*:*:*:*:*:*:*

>>pm7250b>>-

cpe:2.3:h:qualcomm:pm8004:-:*:*:*:*:*:*:*

>>pm8004>>-

cpe:2.3:h:qualcomm:pm8008:-:*:*:*:*:*:*:*

>>pm8008>>-

cpe:2.3:h:qualcomm:pm8009:-:*:*:*:*:*:*:*

>>pm8009>>-

cpe:2.3:h:qualcomm:pm8150:-:*:*:*:*:*:*:*

>>pm8150>>-

cpe:2.3:h:qualcomm:pm8150a:-:*:*:*:*:*:*:*

>>pm8150a>>-

cpe:2.3:h:qualcomm:pm8150b:-:*:*:*:*:*:*:*

>>pm8150b>>-

cpe:2.3:h:qualcomm:pm8150c:-:*:*:*:*:*:*:*

>>pm8150c>>-

cpe:2.3:h:qualcomm:pm8150l:-:*:*:*:*:*:*:*

>>pm8150l>>-

cpe:2.3:h:qualcomm:pm8250:-:*:*:*:*:*:*:*

>>pm8250>>-

cpe:2.3:h:qualcomm:pm855:-:*:*:*:*:*:*:*

>>pm855>>-

cpe:2.3:h:qualcomm:pm855b:-:*:*:*:*:*:*:*

>>pm855b>>-

cpe:2.3:h:qualcomm:pm855l:-:*:*:*:*:*:*:*

>>pm855l>>-

cpe:2.3:h:qualcomm:pm855p:-:*:*:*:*:*:*:*

>>pm855p>>-

cpe:2.3:h:qualcomm:pmc1000h:-:*:*:*:*:*:*:*

>>pmc1000h>>-

cpe:2.3:h:qualcomm:pmk8002:-:*:*:*:*:*:*:*

>>pmk8002>>-

cpe:2.3:h:qualcomm:pmk8003:-:*:*:*:*:*:*:*

>>pmk8003>>-

cpe:2.3:h:qualcomm:pmm6155au:-:*:*:*:*:*:*:*

>>pmm6155au>>-

cpe:2.3:h:qualcomm:pmm8155au:-:*:*:*:*:*:*:*

>>pmm8155au>>-

cpe:2.3:h:qualcomm:pmm8195au:-:*:*:*:*:*:*:*

>>pmm8195au>>-

cpe:2.3:h:qualcomm:pmm855au:-:*:*:*:*:*:*:*

>>pmm855au>>-

cpe:2.3:h:qualcomm:pmr525:-:*:*:*:*:*:*:*

>>pmr525>>-

cpe:2.3:h:qualcomm:pmr735b:-:*:*:*:*:*:*:*

>>pmr735b>>-

cpe:2.3:h:qualcomm:pmx50:-:*:*:*:*:*:*:*

>>pmx50>>-

cpe:2.3:h:qualcomm:pmx55:-:*:*:*:*:*:*:*

>>pmx55>>-

cpe:2.3:h:qualcomm:qat3516:-:*:*:*:*:*:*:*

>>qat3516>>-

cpe:2.3:h:qualcomm:qat3518:-:*:*:*:*:*:*:*

>>qat3518>>-

cpe:2.3:h:qualcomm:qat3519:-:*:*:*:*:*:*:*

>>qat3519>>-

cpe:2.3:h:qualcomm:qat3555:-:*:*:*:*:*:*:*

>>qat3555>>-

cpe:2.3:h:qualcomm:qat5515:-:*:*:*:*:*:*:*

>>qat5515>>-

cpe:2.3:h:qualcomm:qat5522:-:*:*:*:*:*:*:*

>>qat5522>>-

cpe:2.3:h:qualcomm:qat5533:-:*:*:*:*:*:*:*

>>qat5533>>-

cpe:2.3:h:qualcomm:qbt1500:-:*:*:*:*:*:*:*

>>qbt1500>>-

cpe:2.3:h:qualcomm:qbt2000:-:*:*:*:*:*:*:*

>>qbt2000>>-

cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*

>>qca6390>>-

cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*

>>qca6391>>-

cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*

>>qca6420>>-

cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*

>>qca6421>>-

cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*

>>qca6426>>-

cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*

>>qca6430>>-

cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*

>>qca6431>>-

cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*

>>qca6436>>-

cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*

>>qca6574>>-

cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*

>>qca6574a>>-

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov

CWE ID: CWE-119

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin	product-security@qualcomm.com	Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin	nvd@nist.gov	Vendor Advisory

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Source: product-security@qualcomm.com

Resource:

Broken Link

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin

Source: nvd@nist.gov

Resource:

Vendor Advisory

Similar CVEs

2015Records found

CVE-2018-11264

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.29%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 08:01

Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11869

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 12.33%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to buffer overflow in WMA handler.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2024-49840

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 0.09%

7 Day CHG~0.00%

Published-03 Feb, 2025 | 16:51

Updated-05 Feb, 2025 | 16:02

Use of Out-of-range Pointer Offset in WLAN Windows Host

Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.

CWE ID-CWE-823

Use of Out-of-range Pointer Offset

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11274

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.19% / 9.06%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:01

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11871

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 13.55%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Buffer overwrite can happen in WLAN function while processing set pdev parameter command due to lack of input validation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016.

Product-qca9377_firmware sd_850 mdm9635m_firmware mdm9640_firmware sd_820a qca9980_firmware msm8996au_firmware sdm632_firmware sdm632 qca9563_firmware qca9378 mdm9650 qca9558 qca9558_firmware snapdragon_high_med_2016_firmware qca6574 msm8996au qca9880_firmware sd_650 sd_820 sd_450_firmware sd_845_firmware sd_820a_firmware ipq4019_firmware mdm9206 sd_652 qca6564 sd_425_firmware qca9379_firmware qca6174a qca6584au_firmware sd_625_firmware ipq8074 sd_450 sdm636 qca9377 mdm9635m sd_845 mdm9206_firmware qca9563 qca6574_firmware qca9886 qca6584_firmware sd_835_firmware mdm9650_firmware qca9378_firmware sd_835 qca6584 qca6574au_firmware sda660 sd_210_firmware ipq8064 sd_652_firmware sd_600 sd_205_firmware ipq8064_firmware sd_212 sd_650_firmware sd_427_firmware qca6584au sdm636_firmware sdx20 sd_425 sdm660 sd_430_firmware mdm9607_firmware sd_435 sdm630 qca9531 sd_625 ipq8074_firmware qca6574au sdm710 sd_820_firmware sd_210 mdm9607 qca9980 sdm710_firmware qca9880 qca6174a_firmware qca9886_firmware sd_212_firmware snapdragon_high_med_2016 qca6564_firmware sd_850_firmware sdm630_firmware sda660_firmware sd_430 ipq4019 sd_427 sd_435_firmware sdx20_firmware qca9531_firmware sd_600_firmware sd_205 qca9379 sdm660_firmware mdm9640 Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11854

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.11%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 08:17

Lack of check of valid length of input parameter may cause buffer overwrite in WLAN in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11876

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.25% / 15.91%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Lack of input validation while copying to buffer in WLAN will lead to a buffer overflow in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11878

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 11.65%

7 Day CHG~0.00%

Published-19 Sep, 2018 | 14:00

Updated-05 Aug, 2024 | 08:24

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory access while processing driver command in WLAN function.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11862

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.28% / 19.83%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Buffer overflow can happen in WLAN module due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850, SDA660.

Product-sd_850 sd_850_firmware sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11858

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 11.10%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version SD 835, SD 845, SD 850.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sd_845_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11289

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 11.72%

7 Day CHG~0.00%

Published-25 Feb, 2019 | 23:00

Updated-05 Aug, 2024 | 08:01

Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.

Product-sd_850 mdm9150_firmware sd_632 sd_820a sd_675 msm8996au_firmware sd_439 sd_670_firmware sd_429 sdm439 mdm9650 sd_636 snapdragon_high_med_2016_firmware msm8996au sd_820 sd_650 sd_450_firmware sd_845_firmware sd_410 sd_820a_firmware qcs605_firmware sd_675_firmware mdm9206 sd_652 sd_425_firmware sd_625_firmware ipq8074 sd_450 sd_8cx_firmware sd_845 mdm9206_firmware qcs605 sd_632_firmware sd_835_firmware mdm9650_firmware sd_835 sda660 sxr1130_firmware sd_210_firmware sd_652_firmware qca8081_firmware sxr1130 sd_205_firmware sd_212 sd_650_firmware sd_427_firmware sd_712 sd_412 sd_425 sdm660 sd_430_firmware mdm9607_firmware sd_435 mdm9655_firmware sd_710_firmware sdm630 sd_625 ipq8074_firmware sd_820_firmware sd_210 mdm9607 sd_636_firmware sd_439_firmware qca8081 mdm9150 sd_429_firmware snapdragon_high_med_2016 sd_212_firmware sd_850_firmware mdm9655 sdm439_firmware sd_412_firmware sd_712_firmware sdm630_firmware sda660_firmware sd_8cx sd_430 sd_427 sd_670 sd_435_firmware sd_710 sd_410_firmware sd_205 sdm660_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11884

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.25% / 15.91%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Improper input validation leads to buffer overflow while processing network list offload command in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11859

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.10%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

Buffer overwrite can happen in WLAN due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850.

Product-sd_845 sd_850 sd_845_firmware sd_850_firmware Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11853

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.10%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 08:17

Lack of check on out of range for channels When processing channel list set command will lead to buffer flow in Snapdragon Mobile, Snapdragon Wear in version IPQ8074, MDM9206, MDM9607, MDM9650, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11849

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.10%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 08:17

Lack of check on out of range of bssid parameter When processing scan start command will lead to buffer flow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9886, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016

Product-qca9377_firmware sd_850 mdm9635m_firmware qca4531_firmware mdm9640_firmware sd_820a sdm632_firmware msm8996au_firmware sdm632 qca9378 mdm9650 qca6574 msm8996au sd_820 sd_650 sd_450_firmware sd_845_firmware sd_820a_firmware mdm9206 sd_652 qca6564 sd_425_firmware qca9379_firmware qca6174a qca6584au_firmware sd_625_firmware ipq8074 sd_450 sdm636 qca9377 mdm9635m qca4531 sd_845 mdm9206_firmware qca6574_firmware qca9886 qca6584_firmware sd_835_firmware mdm9650_firmware qca9378_firmware sd_835 qca6584 qca6574au_firmware sda660 sd_210_firmware sd_600 sd_652_firmware sd_205_firmware sd_212 sd_650_firmware sd_427_firmware qca6584au sdm636_firmware sdx20 sd_425 sdm660 sd_430_firmware mdm9607_firmware sd_435 sdm630 sd_625 ipq8074_firmware qca6574au sdm710 sd_820_firmware sd_210 mdm9607 sdm710_firmware qca6174a_firmware qca9886_firmware sd_212_firmware qca6564_firmware sd_850_firmware sdm630_firmware sda660_firmware sd_430 sd_427 sd_810 sd_435_firmware sdx20_firmware sd_600_firmware sd_205 qca9379 sd_810_firmware sdm660_firmware mdm9640 Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11863

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 7.45%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received from firmware to calculate the length of WMA roam synch buffer can lead to buffer overwrite during memcpy.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11875

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.25% / 15.91%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Lack of check of buffer size before copying in a WLAN function can lead to a buffer overflow in Snapdragon Mobile in version SD 845, SD 850.

Product-sd_850_firmware sd_845 sd_850 sd_845_firmware Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11856

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.26% / 17.22%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

Improper input validation leads to buffer overwrite in the WLAN function that handles WMI commands in Snapdragon Mobile in version SD 835, SD 845, SD 850.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sd_845_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11857

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 11.10%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

Improper input validation in WLAN encrypt/decrypt module can lead to a buffer copy in Snapdragon Mobile in version SD 835, SD 845, SD 850

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sd_845_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11882

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.26% / 17.39%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Incorrect bound check can lead to potential buffer overwrite in WLAN controller in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11877

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 13.80%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

When the buffer length passed is very large in WLAN, bounds check could be bypassed leading to potential buffer overwrite in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11836

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 9.71%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11880

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.61%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Incorrect bound check can lead to potential buffer overwrite in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.

Product-sd_850 sd_835_firmware sd_850_firmware sd_835 sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11842

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 9.70%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, during wlan association, driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11861

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.28% / 19.83%

7 Day CHG~0.00%

Published-29 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

Buffer overflow can happen in WLAN function due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850, SDA660.

Product-sd_850 sd_850_firmware sda660 sd_845_firmware sda660_firmware sd_845 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11860

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 10.27%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:24

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-11850

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.10%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 08:17

Lack of check on remaining length parameter When processing scan start command will lead to buffer flow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDX20

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2020-11150

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.21% / 11.00%

7 Day CHG~0.00%

Published-21 Jan, 2021 | 09:41

Updated-04 Aug, 2024 | 11:28

Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of pointer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Product-qpm5579 qfs2580 qca8337 qdm5579 qdm2307 qfs2530 qpa8802 pm6125 qat3519 pm8150a qtc800h qdm5670 sa6155 pm7150l qpa8821 qdm5671 pmc1000h qat3518 sd8c wcn3998 wcn3950 wcn3660b qca4020 qdm5652 sd6905g qpm8870 qpm5679 qbt2000 pm855p qca6420 pm6150a sdr735g wcn3999 pm8150b qsm7250 qcs405 qca6430 qat3522 pmr735a wcd9340 sd765g qca6436 sdr660 wcn6851 sa6155p qpa6560 sdr865 wcd9341 smr545 qca6431 qln5020 sd750g qdm3302 sa8150p pm6350 qdm5621 qdm5650 wcn3988 wtr3925 smb1390 pm6150l sd8885g wcn3610 qpm6585 qtc410s wcn3991 smb1355 qln4650 qpa8801 sdm429w wgr7640 qat5568 qet5100 qca6564au sdxr25g pm6150 pm7250b qca6574 qfs2630 qpa8842 wcd9380 qualcomm215 smb1381 sdr735 pm7250 smb1395 pm660l wtr4905 qpa8803 smr526 wcn3980 pmk8003 qdm2301 qsw8573 qcs605 wsa8815 wcn6850 qpm6375 smb1394 wcn3680 pm8009 sdx55m pm670a pm8008 qsw8574 pme605 pm855l qcs603 sd8655g qpm5621 qpm6582 pm670 pm8150l qdm5677 pm8005 sa6145p pm215 qdm2302 pmm6155au sdxr1 ar8031 qpm5577 wtr2965 pm8150 qpm5875 qet5100m sdx55 sa8155p csra6640 pm8350bhs sd675 qet4101 qat3516 pm670l qpm5658 qca9379 pm855b smb2351 qln1031 qpm5870 pm8909 wsa8830 pm660 qln5030 qpm6325 qbt1500 pmi632 qpa5581 csra6620 qpm4621 qcs4290 qet6100 pmm855au sdr660g qpa8686 smb1396 pm7150a wcd9370 pm8350 qca6564 sdr425 qca6426 qca9377 qpm5641 qpm5541 qat5516 qdm5620 qln1021aq sd662 pm8350bh pm3003a sa8155 qat5533 qca6595au wcn3615 sm7350 qpm6670 smb1354 qca6584au qdm2305 qpm8820 qpm4641 pm855 pm8250 smb1398 qdm4643 pmx55 sd205 qca6421 qdm3301 sa8195p qpm5677 qat5515 qat3514 wcd9326 wcd9335 qet4200aq wcd9385 pmm8155au qpm4630 ar8035 qca6390 wcd9375 aqt1000 qpa8673 qdm2310 pmm8195au qln4642 sda429w sd210 wcn3620 pmk7350 qca6564a smr546 pmx24 qet6110 qln5040 qpm8895 qpm5670 wcn3990 qtm527 qca6595 pmk8350 sdx24 qpm8830 pm8350b qat5522 wsa8835 pm8150c pmr735b qpa4360 qca6574a qpa4361 qca6174a pm8350c smr525 qpm4640 wcn6750 pmr525 pm7350c qpm4650 qtm525 sd855 sd8cx sd665 qca6175a sd765 pm640p qat3555 sd460 qca6391 smb1351 qpa5461 qcm4290 pm640a sdr8150 qfs2608 pm8916 qln1036aq qtc801s qdm4650 pmd9655 qca6574au qsw6310 qpm6621 wsa8810 qdm2308 qat3550 wcn6856 qdm5679 wcn3680b sdr8250 sd768g wcn6740 qca6696 qpa2625 pm640l pmk8002 sm7250p qpa5580 Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2024-45584

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.10% / 1.09%

7 Day CHG~0.00%

Published-03 Feb, 2025 | 16:51

Updated-05 Feb, 2025 | 16:01

Untrusted Pointer Dereference in Automotive Android OS

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

CWE ID-CWE-822

Untrusted Pointer Dereference

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2024-45570

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.6||MEDIUM

EPSS-0.09% / 0.69%

7 Day CHG~0.00%

Published-06 May, 2025 | 08:32

Updated-09 May, 2025 | 19:16

Use of Out-of-range Pointer Offset in Camera Driver

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Product-fastconnect_7800_firmware wcd9341 qca6696_firmware qam8295p sw5100p wcd9385_firmware wcn3988_firmware snapdragon_865\+_5g_mobile qca6426 sa9000p wsa8835_firmware qcs610 snapdragon_w5\+_gen_1_wearable_firmware qam8295p_firmware qsm8250_firmware wcn3980 qca6696 sa8540p_firmware c-v2x_9150_firmware qcs410 qsm8250 wsa8832_firmware sa6150p_firmware wcn3620_firmware wcd9385 sa8530p qca6391 sa8295p sxr2230p wcn3620 snapdragon_x55_5g_modem-rf_system snapdragon_865_5g_mobile_firmware fastconnect_6800_firmware sa6155p_firmware snapdragon_429_mobile sa8195p_firmware sw5100p_firmware snapdragon_xr2_5g qca6574au_firmware wcd9370_firmware sa8155p_firmware sdm429w snapdragon_865\+_5g_mobile_firmware fastconnect_6900 c-v2x_9150 snapdragon_8_gen_1_mobile snapdragon_870_5g_mobile_firmware sa8145p_firmware fastconnect_7800 wcn3680b wsa8832 sa8150p sxr2130_firmware wcn3660b wsa8810 wcd9380_firmware sd865_5g_firmware snapdragon_w5\+_gen_1_wearable snapdragon_429_mobile_firmware video_collaboration_vc1_platform_firmware wcd9341_firmware wsa8835 qcn9074_firmware snapdragon_xr2_5g_firmware wcd9370 sdm429w_firmware wsa8830 sa9000p_firmware qca6574au video_collaboration_vc3_platform sa6145p sa8195p sa6150p snapdragon_8_gen_1_mobile_firmware wsa8815_firmware snapdragon_865_5g_mobile wcn3980_firmware wcn3950_firmware sa8530p_firmware sa8540p sa8295p_firmware sd865_5g sw5100_firmware video_collaboration_vc3_platform_firmware sw5100 snapdragon_x55_5g_modem-rf_system_firmware sxr2250p sxr2130 wsa8810_firmware sxr2230p_firmware fastconnect_6800 qca6426_firmware sa8150p_firmware snapdragon_870_5g_mobile wcn3950 wcn3988 wcn3680b_firmware wsa8830_firmware sxr2250p_firmware wcd9380 sdx55_firmware wsa8815 qcs610_firmware qca6436_firmware qca6436 sa6155p sa8155p sdx55 sa8145p video_collaboration_vc1_platform fastconnect_6900_firmware sa6145p_firmware qcn9074 wcn3660b_firmware qca6391_firmware qcs410_firmware Snapdragon

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-823

Use of Out-of-range Pointer Offset

CVE-2024-43053

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.10% / 1.19%

7 Day CHG~0.00%

Published-02 Dec, 2024 | 10:18

Updated-12 Dec, 2024 | 15:29

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.

Product-fastconnect_7800 qca2062_firmware qca2066 wcd9380_firmware sdm429w wsa8840_firmware fastconnect_6900 fastconnect_6900_firmware sc8380xp_firmware wsa8840 sdm429w_firmware fastconnect_6700_firmware snapdragon_7c\+_gen_3_compute wcd9380 fastconnect_7800_firmware wsa8845h fastconnect_6700 qca2064_firmware qca2062 wcd9385 qca2066_firmware qca2065_firmware qcc2076_firmware wcd9385_firmware wsa8845 snapdragon_429_mobile_platform qcc2073_firmware qca2064 wcn3660b qca2065 qcc2076 wsa8845_firmware wcn3620_firmware snapdragon_7c\+_gen_3_compute_firmware wcn3660b_firmware sc8380xp snapdragon_429_mobile_platform_firmware wcn3620 wsa8845h_firmware qcc2073 Snapdragon qca2062_firmware wcd9380_firmware qca2066_firmware qca2065_firmware qcc2076_firmware wsa8840_firmware wcd9385_firmware fastconnect_6900_firmware qcc2073_firmware sc8380xp_firmware wsa8845_firmware wcn3620_firmware sdm429w_firmware fastconnect_6700_firmware wcn3660b_firmware snapdragon_429_mobile_platform_firmware fastconnect_7800_firmware wsa8845h_firmware qca2064_firmware

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-43049

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.10% / 1.19%

7 Day CHG~0.00%

Published-02 Dec, 2024 | 10:18

Updated-12 Dec, 2024 | 15:28

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Product-fastconnect_7800 wcd9380_firmware wsa8830 sdm429w wsa8840_firmware fastconnect_6900 fastconnect_6900_firmware sc8380xp_firmware qcc2073 wsa8835 wsa8840 sdm429w_firmware fastconnect_6700_firmware snapdragon_7c\+_gen_3_compute wcd9380 fastconnect_7800_firmware wsa8845h fastconnect_6700 snapdragon_8cx_gen_3_compute_platform wcd9385 qcc2076_firmware wcd9385_firmware wsa8845 qcc2073_firmware wcn3660b wsa8830_firmware qcc2076 wsa8845_firmware wcn3620_firmware snapdragon_7c\+_gen_3_compute_firmware wcn3660b_firmware wsa8835_firmware sc8380xp snapdragon_429_mobile_platform_firmware wcn3620 wsa8845h_firmware snapdragon_429_mobile_platform snapdragon_8cx_gen_3_compute_platform_firmware Snapdragon wcd9380_firmware qcc2076_firmware wsa8840_firmware wcd9385_firmware fastconnect_6900_firmware qcc2073_firmware sc8380xp_firmware wsa8830_firmware wsa8845_firmware wcn3620_firmware sdm429w_firmware fastconnect_6700_firmware wcn3660b_firmware wsa8835_firmware snapdragon_429_mobile_platform_firmware fastconnect_7800_firmware wsa8845h_firmware

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-8245

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 7.65%

7 Day CHG+0.01%

Published-12 May, 2017 | 20:00

Updated-13 May, 2026 | 00:24

In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28551

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.12% / 2.01%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18303

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.28% / 20.17%

7 Day CHG~0.00%

Published-23 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 21:20

While processing the sensors registry configuration file, if inputs are not validated a buffer overflow will occur in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MMDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SDA660, SDX20.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-18158

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.19% / 9.33%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 23:16

Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05 while flashing images.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-18154

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 6.71%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-17 Sep, 2024 | 03:03

A crafted binder request can cause an arbitrary unmap in MediaServer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-18329

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 15.29%

7 Day CHG~0.00%

Published-03 Jan, 2019 | 15:00

Updated-05 Aug, 2024 | 21:20

Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 835, SD 845 / SD 850, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130

Product-sd_850 mdm9635m_firmware mdm9640_firmware msm8996au_firmware sd_670_firmware mdm9650 sd_636 sd_615_firmware snapdragon_high_med_2016_firmware msm8909w_firmware msm8996au mdm9645 sd_650 sd_820 sd_450_firmware sd_845_firmware sd_652 sd_425_firmware sd_625_firmware sd_450 mdm9635m mdm9615 sd_845 sd_835_firmware mdm9650_firmware sd_835 sda660 sxr1130_firmware sd_210_firmware sd_415_firmware sd_652_firmware sxr1130 msm8909w sd_616_firmware sd_205_firmware sd_415 sd_650_firmware sd_212 sd_427_firmware sd_712 sd_616 sd_425 sdm660 sd_430_firmware sd_615 sd_435 mdm9655_firmware sd_710_firmware sdm630 sd_625 sd_210 sd_820_firmware sd_636_firmware mdm9645_firmware mdm9625_firmware snapdragon_high_med_2016 sd_212_firmware sd_850_firmware mdm9655 sd_712_firmware sdm630_firmware sda660_firmware mdm9625 sd_427 sd_430 sd_670 sd_810 sd_435_firmware mdm9615_firmware sd_710 sd_205 sd_810_firmware sdm660_firmware mdm9640 Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-18295

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.28% / 20.17%

7 Day CHG~0.00%

Published-23 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 21:20

Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDX20.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-17767

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.64%

7 Day CHG~0.00%

Published-23 Feb, 2018 | 23:00

Updated-17 Sep, 2024 | 03:28

In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28545

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.2||HIGH

EPSS-0.14% / 3.72%

7 Day CHG~0.00%

Published-07 Nov, 2023 | 05:26

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18124

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 12.26%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 21:13

During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDX20

Product-sd_850 mdm9635m_firmware mdm9640_firmware sd_820a msm8996au_firmware mdm9650 sd_615_firmware msm8909w_firmware msm8996au mdm9645 sd_650 sd_820 sd_450_firmware sd_845_firmware sd_410 sd_820a_firmware ipq4019_firmware mdm9206 sd_652 sd_425_firmware sd_800_firmware sd_625_firmware sd_450 mdm9635m sd_845 mdm9206_firmware mdm9640 sd_835_firmware mdm9650_firmware sd_835 sda660 sd_210_firmware sd_415_firmware sd_652_firmware msm8909w sd_616_firmware sd_205_firmware sd_415 sd_650_firmware sd_212 fsm9055 sd_412 sdx20 sd_616 sd_425 sd_430_firmware mdm9607_firmware sd_615 mdm9655_firmware sd_625 sd_210 mdm9607 sd_820_firmware mdm9645_firmware mdm9625_firmware fsm9055_firmware sd_800 sd_617 sd_212_firmware sd_850_firmware mdm9655 sd_412_firmware sda660_firmware mdm9625 sd_430 ipq4019 sd_810 sdx20_firmware sd_410_firmware sd_205 sd_810_firmware sd_617_firmware Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28587

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.32%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-14884

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 7.09%

7 Day CHG~0.00%

Published-23 Feb, 2018 | 23:00

Updated-16 Sep, 2024 | 18:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "data_len" from the function WLANQCMBR_McProcessMsg, a buffer overflow may potentially occur in WLANFTM_McProcessMsg.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-14897

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.34%

7 Day CHG~0.00%

Published-05 Dec, 2017 | 19:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND, a userspace buffer is directly accessed in kernel space.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-33106

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.85% / 54.28%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:04

Updated-28 Oct, 2025 | 13:47

Known KEV||Action Due Date - 2023-12-26||Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.