ByteOS

Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Product

Versions

Affected

AQT1000, AR8035, CSRB31024, FSM10055, FSM10056, MDM9150, MDM9250, MDM9650, QCA6174A, QCA6390, QCA6391, QCA6420, QCA6426, QCA6430, QCA6436, QCA6564A, QCA6564AU, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCA9377, QCS410, QCS603, QCS605, QCS610, QCX315, SA415M, SA515M, SD 675, SD 8CX, SD480, SD660, SD665, SD675, SD678, SD690 5G, SD720G, SD730, SD750G, SD765, SD765G, SD768G, SD7c, SD845, SD850, SD855, SD865 5G, SD870, SDX12, SDX20, SDX24, SDX55, SDX55M, SDX65, SDXR1, SDXR2 5G, SM6250, SM6250P, SM6375, SM7250P, SM8450, SM8450P, WCD9326, WCD9335, WCD9340, WCD9341, WCD9360, WCD9370, WCD9375, WCD9380, WCD9385, WCN3950, WCN3980, WCN3988, WCN3990, WCN3991, WCN3998, WCN6850, WCN6851, WCN6855, WCN6856, WSA8810, WSA8815, WSA8830, WSA8835

Problem Types

Type	CWE ID	Description
text	N/A	Integer Overflow to Buffer Overflow in Modem

Type: text

CWE ID: N/A

Description: Integer Overflow to Buffer Overflow in Modem

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin	x_refsource_CONFIRM

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin	x_refsource_CONFIRM x_transferred

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@qualcomm.com

Published At:03 Jan, 2022 | 08:15

Updated At:11 Jan, 2022 | 16:12

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.6

Base severity: MEDIUM

Vector:

AV:L/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*

>>aqt1000_firmware>>-

cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*

>>aqt1000>>-

cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*

>>ar8035_firmware>>-

cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*

>>ar8035>>-

cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*

>>csrb31024_firmware>>-

cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*

>>csrb31024>>-

cpe:2.3:o:qualcomm:fsm10055_firmware:-:*:*:*:*:*:*:*

>>fsm10055_firmware>>-

cpe:2.3:h:qualcomm:fsm10055:-:*:*:*:*:*:*:*

>>fsm10055>>-

cpe:2.3:o:qualcomm:fsm10056_firmware:-:*:*:*:*:*:*:*

>>fsm10056_firmware>>-

cpe:2.3:h:qualcomm:fsm10056:-:*:*:*:*:*:*:*

>>fsm10056>>-

cpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*

>>mdm9150_firmware>>-

cpe:2.3:h:qualcomm:mdm9150:-:*:*:*:*:*:*:*

>>mdm9150>>-

cpe:2.3:o:qualcomm:mdm9250_firmware:-:*:*:*:*:*:*:*

>>mdm9250_firmware>>-

cpe:2.3:h:qualcomm:mdm9250:-:*:*:*:*:*:*:*

>>mdm9250>>-

cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*

>>mdm9650_firmware>>-

cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*

>>mdm9650>>-

cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*

>>qca6174a_firmware>>-

cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*

>>qca6174a>>-

cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*

>>qca6390_firmware>>-

cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*

>>qca6390>>-

cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*

>>qca6391_firmware>>-

cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*

>>qca6391>>-

cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*

>>qca6420_firmware>>-

cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*

>>qca6420>>-

cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*

>>qca6426_firmware>>-

cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*

>>qca6426>>-

cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*

>>qca6430_firmware>>-

cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*

>>qca6430>>-

cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*

>>qca6436_firmware>>-

cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*

>>qca6436>>-

cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*

>>qca6564a_firmware>>-

cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*

>>qca6564a>>-

cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*

>>qca6564au_firmware>>-

cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*

>>qca6564au>>-

cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*

>>qca6574a_firmware>>-

cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*

>>qca6574a>>-

cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*

>>qca6574au_firmware>>-

cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*

>>qca6574au>>-

cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*

>>qca6595au_firmware>>-

cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*

>>qca6595au>>-

cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*

>>qca6696>>-

cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*

>>qca6696_firmware>>-

cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*

>>qca8081>>-

cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*

>>qca8081_firmware>>-

cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*

>>qca8337>>-

cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*

>>qca8337_firmware>>-

cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*

>>qca9377>>-

cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*

>>qca9377_firmware>>-

cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*

>>qcs410>>-

cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*

>>qcs410_firmware>>-

Weaknesses

CWE ID	Type	Source
CWE-190	Primary	nvd@nist.gov

CWE ID: CWE-190

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin	product-security@qualcomm.com	Vendor Advisory

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin

Source: product-security@qualcomm.com

Resource:

Vendor Advisory

Similar CVEs

1411Records found

CVE-2019-10615

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 10.35%

7 Day CHG~0.00%

Published-08 Sep, 2020 | 09:31

Updated-04 Aug, 2024 | 22:32

u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Product-mdm9150_firmware kamorta_firmware qcm2150_firmware qcs610 sdm429w msm8996au_firmware sdm632_firmware sdm845 sdm450_firmware sdm632 sdx24 sdm439 qcs404_firmware mdm9650 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8909w_firmware msm8996au sdm429w_firmware sm7150 apq8009_firmware msm8917 sdm670 sxr2130 qcs605_firmware sc8180x mdm9206 sdm670_firmware qcs404 sdx24_firmware sdm636 sda845_firmware sa415m apq8098 mdm9205 mdm9206_firmware sa515m qcs605 msm8937_firmware mdm9650_firmware sdm429_firmware msm8905_firmware sda660 sdx55_firmware sxr1130_firmware sxr1130 msm8909w apq8009 msm8909_firmware apq8053_firmware sda845 nicobar sdm850_firmware sa6155p_firmware msm8920 msm8953 sdm450 sdm636_firmware sa515m_firmware apq8098_firmware msm8998_firmware qcm2150 msm8920_firmware sdm630 mdm9607_firmware sm8250_firmware sdm660 sc8180x_firmware sa415m_firmware qcs405 sdm710 qm215 sc7180_firmware mdm9607 apq8017_firmware sdm710_firmware sa6155p qcs610_firmware mdm9150 msm8937 msm8996_firmware msm8905 sm8150_firmware msm8909 sxr2130_firmware apq8096au sdm439_firmware qcs405_firmware rennell sc7180 sdm630_firmware mdm9205_firmware sda660_firmware rennell_firmware qm215_firmware sdx55 msm8953_firmware msm8940 sm6150_firmware apq8053 apq8096au_firmware msm8917_firmware sm8250 msm8998 sm8150 sdm850 kamorta apq8017 msm8996 nicobar_firmware sdm660_firmware sdm845_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-10530

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.19% / 8.91%

7 Day CHG~0.00%

Published-12 Dec, 2019 | 08:30

Updated-04 Aug, 2024 | 22:24

Lack of check of data truncation on user supplied data in kernel leads to buffer overflow in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24

Product-sd_850 mdm9150_firmware sd_632 mdm9640_firmware sd_820a sd_675 msm8996au_firmware sd_439 sd_670_firmware sd_429 sdx24 sdm439 mdm9650 sd_636 msm8909w_firmware msm8996au sd_450_firmware sd_845_firmware sd_820a_firmware qcs605_firmware sd_675_firmware mdm9206 sd_425_firmware sd_665 sdx24_firmware sd_625_firmware sd_450 sd_845 mdm9206_firmware qcs605 mdm9640 sd_632_firmware sd_835_firmware mdm9650_firmware sd_835 sda660 sd_210_firmware msm8909w sd_665_firmware sd_205_firmware sd_212 sd_712 sd_855 sd_730_firmware sdx20 sd_425 sdm660 sdm630 mdm9607_firmware sd_710_firmware qcs405 sd_625 sd_210 mdm9607 sd_636_firmware sd_439_firmware mdm9150 sd_429_firmware sd_730 sd_212_firmware sd_850_firmware sdm439_firmware qcs405_firmware sd_712_firmware sdm630_firmware sda660_firmware sd_670 sd_710 sdx20_firmware sd_205 sdm660_firmware sd_855_firmware Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-10585

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 10.29%

7 Day CHG~0.00%

Published-21 Jan, 2020 | 06:30

Updated-04 Aug, 2024 | 22:24

Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MDM9607, MDM9640, MSM8909W, MSM8917, MSM8953, Nicobar, QCS605, QM215, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX24, SDX55, SM6150, SM8150, SM8250, SXR1130, SXR2130

CWE ID-CWE-416

Use After Free

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-13994

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 13.43%

7 Day CHG~0.00%

Published-08 Sep, 2020 | 09:31

Updated-05 Aug, 2024 | 00:05

u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than the actual packet size can lead to memory corruption and potential information leakage' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Bitra, IPQ6018, IPQ8074, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCM2150, QCN7605, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Product-mdm9150_firmware mdm9640_firmware qcs610 sdm450_firmware sdm632 qcs404_firmware mdm9650 mdm9645 apq8009_firmware msm8917 sdm670 qcs605_firmware sda845_firmware sa415m bitra apq8098 qcn7605 mdm9206_firmware bitra_firmware msm8905_firmware sda660 sdx55_firmware qca8081_firmware sxr1130 apq8053_firmware sda845 sa6155p_firmware sdm450 sdm636_firmware apq8098_firmware msm8998_firmware sdm630 mdm9607_firmware sm8250_firmware mdm9655_firmware sa415m_firmware qcs405 qm215 sc7180_firmware apq8017_firmware sdm710_firmware sa6155p qca8081 msm8937 msm8905 sm8150_firmware msm8909 sxr2130_firmware mdm9655 rennell sc7180 msm8953_firmware saipan_firmware sm6150_firmware msm8917_firmware msm8998 sm8150 sdx20_firmware sdm850 kamorta apq8017 msm8996 saipan mdm9640 kamorta_firmware qcm2150_firmware sdm429w msm8996au_firmware sdm632_firmware sdm845 sdx24 sdm439 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8996au sdm429w_firmware sm7150 sxr2130 sc8180x mdm9206 sdm670_firmware qcs404 sdx24_firmware ipq8074 sdm636 ipq6018_firmware mdm9205 qcs605 msm8937_firmware mdm9650_firmware sdm429_firmware sxr1130_firmware apq8009 msm8909_firmware nicobar sdm850_firmware msm8920 msm8953 sdx20 qcm2150 msm8920_firmware sdm660 sc8180x_firmware ipq8074_firmware sdm710 mdm9607 mdm9645_firmware qcn7605_firmware qcs610_firmware mdm9150 msm8996_firmware ipq6018 apq8096au sdm439_firmware qcs405_firmware sdm630_firmware mdm9205_firmware sda660_firmware rennell_firmware qm215_firmware sdx55 msm8940 apq8053 apq8096au_firmware sm8250 nicobar_firmware sdm660_firmware sdm845_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2024-23372

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.13% / 3.08%

7 Day CHG~0.00%

Published-01 Jul, 2024 | 14:17

Updated-01 Aug, 2024 | 23:06

Integer Overflow or Wraparound in Graphics

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2024-21470

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.11% / 1.58%

7 Day CHG~0.00%

Published-01 Apr, 2024 | 15:06

Updated-13 Jan, 2025 | 21:54

Integer Overflow to Buffer Overflow in Graphics Windows

Memory corruption while allocating memory for graphics.

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5898

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.67%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-17 Sep, 2024 | 01:06

Integer overflow can occur in msm_pcm_adsp_stream_cmd_put() function if the user supplied data "param_length" goes beyond certain limit in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5907

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 6.93%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 22:26

Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that leads to integer overflow in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5848

Matching Score-10

Assigner-Qualcomm, Inc.

Product-enterprise_linux_server debian_linux android enterprise_linux_workstation virtualization_host enterprise_linux_desktop Android for MSM, Firefox OS for MSM, QRD Android

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.37% / 28.91%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 00:31

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Vendor-Qualcomm Technologies, Inc.Google LLC Debian GNU/Linux Red Hat, Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2025-47323

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.08% / 0.30%

7 Day CHG~0.00%

Published-18 Dec, 2025 | 05:29

Updated-28 Jan, 2026 | 17:04

Integer Overflow or Wraparound in Audio

Memory corruption while routing GPR packets between user and root when handling large data packet.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-22667

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 1.88%

7 Day CHG~0.00%

Published-04 Jul, 2023 | 04:46

Updated-11 Aug, 2025 | 15:06

Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while allocating the ion buffer during the music playback.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-21644

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.11% / 1.49%

7 Day CHG~0.00%

Published-05 Sep, 2023 | 06:23

Updated-06 Sep, 2024 | 14:34

Integer Overflow to Buffer Overflow in RIL

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.

Product-wcn3991_firmware wcn3991 wsa8830 sda429w_firmware sa6150p_firmware wcd9380_firmware sa8145p_firmware sw5100p sd865_5g qcc5100 sdx55m_firmware wcd9360_firmware wsa8835 wcd9380 sa8150p_firmware qca6420_firmware qca6595au_firmware qca6390_firmware wcd9370 qca6574a qca6426 qca6430_firmware wcn3980 sm4375 wcn3998 wcd9385_firmware sdxr2_5g_firmware sa515m wcn3660b sd855 wsa8815 wcn6850 qca6426_firmware wcn3660b_firmware qca6574a_firmware sd695 qca6574au_firmware sdx55_firmware wcn3680b_firmware qca6595au wcd9375_firmware wcn3998_firmware wcn3980_firmware qca6391 wcn3610_firmware wcd9360 qca6420 qca6436_firmware sdx55m qcc5100_firmware aqt1000_firmware sa6155p_firmware sa515m_firmware sdxr2_5g sd480_firmware wcn6851_firmware wcn3988_firmware qca6430 qca6574au sa6145p_firmware sa8155p_firmware sa8195p wsa8810_firmware wcd9341_firmware sm4375_firmware sw5100 sd480 sd870 qca6436 wcn6851 wsa8810 sa6155p sw5100p_firmware sa6145p wcn3680b wcd9385 wcd9341 sd695_firmware qca6696_firmware sa8145p sd870_firmware qca6696 qca6391_firmware qca6390 wcd9375 wcd9370_firmware aqt1000 sa8150p sa6150p sdx55 sa8155p wsa8830_firmware sda429w sd855_firmware sd865_5g_firmware wcn3988 wcn6850_firmware wsa8815_firmware wsa8835_firmware sa8195p_firmware sw5100_firmware wcn3610 Snapdragon aqt1000_firmware qca6564au_firmware sa6155p_firmware sda429w_firmware wcd9380_firmware sa6150p_firmware sa8145p_firmware sa515m_firmware wsa8835_firmware wcn6851_firmware sdx55m_firmware wcd9360_firmware wcn3988_firmware sa6145p_firmware sa8155p_firmware wsa8810_firmware sa8150p_firmware wcd9341_firmware qca6420_firmware qca6595au_firmware qca6390_firmware sw5100p_firmware qca6564_firmware qca6696_firmware qca6430_firmware sd870_firmware qca6391_firmware sdxr2_5g_firmware wsa8830_firmware sd855_firmware sd865_5g_firmware qca6426_firmware wcn3660b_firmware wcn6850_firmware qca6574a_firmware wsa8815_firmware qca6574au_firmware sa8195p_firmware sdx55_firmware wcn3680b_firmware sw5100_firmware wcn3998_firmware wcn3980_firmware wcn3610_firmware qca6436_firmware qcc5100_firmware

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-21655

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.11% / 1.48%

7 Day CHG~0.00%

Published-05 Sep, 2023 | 06:23

Updated-02 Aug, 2024 | 09:44

Integer Overflow or Wraparound in Display

Memory corruption in Audio while validating and mapping metadata.

Product-sa6155p_firmware sda429w_firmware wcd9380_firmware sa6150p_firmware wsa8830 sa8145p_firmware sw5100p wcn7851 wcn6851_firmware qcc5100 wcn6856_firmware wcn3988_firmware qca6574au sa6145p_firmware sa8155p_firmware wsa8835 sa8195p sd_8_gen1_5g wcd9380 sa8150p_firmware sd888_5g sw5100 wcn6855 wcn6851 sa6155p sw5100p_firmware wcn7851_firmware wcn6856 sa6145p wcn3680b wcn6855_firmware wcd9385 qca6696_firmware wcn3980 sa8145p qca6696 qca6391_firmware wcd9385_firmware sa8150p sd_8_gen1_5g_firmware sa6150p wcn3660b wcn6850 sa8155p wsa8830_firmware sda429w wcn3988 sd888_5g_firmware wcn3660b_firmware wcn6850_firmware wcn7850_firmware qca6574au_firmware sa8195p_firmware wcn3680b_firmware wcn7850 sw5100_firmware wsa8835_firmware wcn3980_firmware qca6391 wcn3610_firmware wcn3610 qcc5100_firmware Snapdragon wcn6855_firmware sa6155p_firmware sda429w_firmware wcd9380_firmware sa6150p_firmware sa8145p_firmware qca6696_firmware qca6391_firmware wcd9385_firmware wcn6851_firmware wcn6856_firmware sd_8_gen1_5g_firmware wcn3988_firmware wsa8830_firmware sa6145p_firmware sa8155p_firmware sd888_5g_firmware wcn3660b_firmware wcn6850_firmware wcn7850_firmware sa8150p_firmware qca6574au_firmware sa8195p_firmware wcn3680b_firmware wsa8835_firmware sw5100_firmware wcn3980_firmware sw5100p_firmware wcn3610_firmware wcn7851_firmware qcc5100_firmware

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-40532

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 1.88%

7 Day CHG~0.00%

Published-04 Apr, 2023 | 04:46

Updated-03 Aug, 2024 | 12:21

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-33296

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-5.9||MEDIUM

EPSS-0.11% / 1.82%

7 Day CHG~0.00%

Published-04 Apr, 2023 | 04:46

Updated-03 Aug, 2024 | 08:01

Integer overflow to buffer overflow in Modem

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-33269

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.12% / 1.88%

7 Day CHG~0.00%

Published-04 Apr, 2023 | 04:46

Updated-03 Aug, 2024 | 08:01

Integer overflow or wraparound in Core

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-33219

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.13% / 3.27%

7 Day CHG~0.00%

Published-06 Jan, 2023 | 05:02

Updated-09 Apr, 2025 | 19:49

Integer Overflow to Buffer Overflow in Automotive

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-33282

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 1.99%

7 Day CHG~0.00%

Published-04 Apr, 2023 | 04:46

Updated-11 Feb, 2025 | 14:22

Integer overflow to buffer overflow in Automotive Multimedia

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2020-11160

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.15% / 4.59%

7 Day CHG~0.00%

Published-09 Jun, 2021 | 05:00

Updated-04 Aug, 2024 | 11:28

Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Product-qpm5579 qfs2580 qcs610 qca8337 qfs2530 qln1030 pm6125 qat3519 qbt2000_firmware wcn3950_firmware pm8150a qtc800h sdr8250_firmware qca6595au_firmware qpm5541_firmware csra6620_firmware csra6640_firmware pmc1000h wtr5975_firmware sdr425_firmware wcn3998 smr526_firmware wcn3950 pm640a_firmware qsw8573_firmware wcn3660b wgr7640_firmware qsw8574_firmware sd460_firmware qca4020 smb2351_firmware qca6574au_firmware qpa4360_firmware wcd9375_firmware wcn3998_firmware qbt2000 pm855p qca6420 wcn3999 pm8150b sa8155_firmware sd662_firmware qcs405 qca6430 qat3522 wcd9340 qualcomm215_firmware qca4020_firmware sdr660 wcn6851 sa6155p qpa6560 sdr865 wcd9341 qca6696_firmware qet4100_firmware pmm855au_firmware sd_8cx sd855_firmware sd865_5g_firmware wcn3988 wtr3925 pm640p_firmware smb1390 pm6150l pm855l_firmware qet4100 wcn3610 qtc410s qca8337_firmware sda429w_firmware wcd9380_firmware smb1355 sdm429w wgr7640 qca6564au pm8150l_firmware qtm527_firmware sdx55m_firmware qpa8673_firmware pm6150 qet4101_firmware smb1354_firmware qca6574 pmm8996au wcd9380 smb1355_firmware smb1351_firmware pmd9655_firmware qualcomm215 qcs410 qpm5579_firmware smb1381 pm855p_firmware qca9379_firmware smr526 wtr5975 qca6430_firmware wcd9335_firmware qtc801s_firmware wcn3980 qat3522_firmware qdm2301 qsw8573 wcd9340_firmware wsa8815 wcn6850 qpm6375 qdm2301_firmware mdm9650_firmware sd_8c_firmware qca6426_firmware wcn3660b_firmware wcn3680 pm8009 wcn3980_firmware sdx55m pm8008 qtm525_firmware qsw8574 ar8031_firmware wcn3680_firmware pm855l wcn6851_firmware qpa6560_firmware pm8150b_firmware pmc1000h_firmware qca6564a_firmware pm8009_firmware qfs2580_firmware pm8150l qcs610_firmware pm855_firmware sa6145p pm215 qdm2302 pmm6155au pm855b_firmware apq8096au ar8031 qcs405_firmware qpm5577 qpm6375_firmware wtr2965 pm640l_firmware qca6391_firmware pm8150 wcd9370_firmware sdx55 sa8155p csra6640 sd675 qet4101 qat3555_firmware qca9379 pm855b smb2351 ar8035_firmware pmm8155au_firmware qpm6325 pm6125_firmware qbt1500 pmi632 mdm9650 csra6620 qbt1500_firmware pmm855au qca6420_firmware qca6390_firmware wcd9370 sd675_firmware qpa4361_firmware sdr425 pmr525_firmware qca6426 qca6584au_firmware pmi632_firmware sd_8cx_firmware wcd9385_firmware qpm5541 wcd9326_firmware wcn3615_firmware sd662 pmk8002_firmware pm3003a qsw6310_firmware sa8155 wcn3680b_firmware sdx55_firmware pmm6155au_firmware qca6595au wcn3615 wcn3999_firmware wcn3610_firmware smb1354 qca6564au_firmware qca6584au sa6155p_firmware pm855 pm8250 qfs2530_firmware wcn3988_firmware pmx55 sa6145p_firmware pm8150c_firmware qat3519_firmware wsa8810_firmware wcd9326 wcd9335 qca6174a_firmware sdr8150_firmware wcd9385 qpm6325_firmware qtc800h_firmware qdm2302_firmware qat3550_firmware pmm8155au ar8035 qca6390 wcd9375 aqt1000 qpa8673 sda429w wcn3620_firmware wsa8815_firmware wcn6850_firmware smr525_firmware wcn3620 wtr3925_firmware qca6564a pmx55_firmware qtm527 sd865_5g pm8150_firmware pmm8996au_firmware sdm429w_firmware pm8150c sd665_firmware qpa4360 sdr660_firmware qca6574a qpa4361 qpm5577_firmware pm8916_firmware smb1390_firmware qca6174a smr525 pm6150l_firmware pmr525 pm8150a_firmware qtm525 qca6574_firmware sd855 sd665 pm6150_firmware pm640p qca6574a_firmware sdr865_firmware qat3555 pm8250_firmware sd460 qca6391 smb1351 aqt1000_firmware pm215_firmware wtr2965_firmware pm640a sdr8150 pm8916 qtc801s pmd9655 qca6574au sa8155p_firmware qsw6310 pm8008_firmware wcd9341_firmware wsa8810 qtc410s_firmware qat3550 sd_8c wcn3680b sdr8250 pm3003a_firmware qln1030_firmware qca6696 smb1381_firmware pm640l pmk8002 apq8096au_firmware qcs410_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2026-21385

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-1.07% / 61.04%

7 Day CHG~0.00%

Published-02 Mar, 2026 | 16:53

Updated-04 Mar, 2026 | 18:13

Known KEV||Action Due Date - 2026-03-24||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-11985

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.15%

7 Day CHG~0.00%

Published-20 Dec, 2018 | 15:00

Updated-05 Aug, 2024 | 08:24

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, When allocating heap using user supplied size, Possible heap overflow vulnerability due to integer overflow in roundup to native pointer.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-11923

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 9.55%

7 Day CHG~0.00%

Published-24 May, 2019 | 16:31

Updated-05 Aug, 2024 | 08:24

Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handler in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-13998

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 10.35%

7 Day CHG~0.00%

Published-08 Sep, 2020 | 09:31

Updated-05 Aug, 2024 | 00:05

u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corruption and potential information leakage' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Bitra, IPQ6018, IPQ8074, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCM2150, QCN7605, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-25705

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.12% / 2.56%

7 Day CHG~0.00%

Published-07 Mar, 2023 | 04:43

Updated-03 Aug, 2024 | 04:49

Integer Overflow to Buffer Overflow in Modem

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

Product-qca9377_firmware mdm9640_firmware sm6250p_firmware qcs610 qca8337 qca6431_firmware wcd9360_firmware sdx65 wcn3950_firmware sc8180x\+sdx55 qcs2290 qca6595au_firmware qca6335 msm8917 sd_455_firmware csra6620_firmware qcs605_firmware apq8076 sd_675_firmware csra6640_firmware qcs6125_firmware sd632 msm8108 sa415m wcn3998 wcd9371_firmware msm8108_firmware wcn3950 qcn6024_firmware sd720g sd_8cx_gen2_firmware mdm9206_firmware qsw8573_firmware mdm9628 sd_8_gen1_5g_firmware wcn3660b sd450_firmware sd710_firmware sd460_firmware mdm9230_firmware sm7315_firmware wcn7850 qca6574au_firmware mdm9630 wcd9375_firmware qca8081_firmware wcn3998_firmware sdx12_firmware msm8909w apq8009w_firmware qca6420 wcd9360 sd680_firmware qca9367_firmware mdm8207 sd_8cx_gen2 qcs6125 apq8056_firmware qca4004_firmware sd662_firmware qcs405 qca6430 qts110 wcd9306_firmware wcd9340 sd626_firmware sd765g qualcomm215_firmware sw5100 sd680 qca6436 wcn6851 qcs603_firmware wcn7851_firmware msm8937 apq8052 msm8209_firmware mdm9250_firmware wcn3660_firmware wcd9341 mdm9655 qca6696_firmware qca6431 wcd9371 sd870_firmware sd750g wcn3910_firmware mdm9207_firmware qca4004 wsa8830_firmware mdm9330_firmware sd855_firmware sd660 sd865_5g_firmware snapdragon_4_gen_1 sd712 wcn3988 sd660_firmware wcn7850_firmware sm8475 msm8208_firmware wcn6750_firmware sd450 wcn3610 msm8608 mdm9640 wcn3991 qca8337_firmware sda429w_firmware wcd9380_firmware sdm429w sw5100p msm8996au_firmware wcd9330 sd625_firmware qca6564au sdx55m_firmware wcn6856_firmware msm8940_firmware qet4101_firmware msm8976_firmware qca6574 sd632_firmware sd670_firmware wcd9380 qualcomm215 mdm9230 qcs410 sd690_5g_firmware sdx50m_firmware qca9379_firmware sdx24_firmware sd626 qca6174 qca6430_firmware sd439_firmware wcd9335_firmware wcn3980 qca6335_firmware qsw8573 qcm4325_firmware qcs605 wcd9340_firmware wsa8815 wcn6850 sd7c wcn3910 msm8956_firmware qca6584_firmware qca6320 msm8937_firmware mdm9650_firmware qca6426_firmware wcn3660b_firmware wcn3680 sd695 sd835 qcn9024 wcn3980_firmware sd730 wcd9330_firmware sdx55m qcc5100_firmware qca6421_firmware wcn6740_firmware sd821_firmware sd678_firmware wcn3680_firmware wcn6851_firmware qcs603 sd670 sd_636_firmware qcn9024_firmware qca6564a_firmware apq8009w msm8976sg_firmware sdx57m qcm4290_firmware sd480 sd870 wcn6855 sw5100p_firmware sd210_firmware qcs610_firmware sd695_firmware sdxr1 apq8096au qcs405_firmware mdm8207_firmware sdm630_firmware mdm9205_firmware qca6391_firmware sd820_firmware wcd9370_firmware sd780g_firmware sdx55 sd888_firmware sd675 csra6640 sdx70m sd439 qet4101 wcn3660 qca9379 ar8035_firmware qcm2290 wcn3991_firmware mdm9150_firmware wsa8830 sd678 qcs2290_firmware sd7c_firmware csrb31024 mdm9628_firmware snapdragon_4_gen_1_firmware mdm9650 sd_636 csra6620 qcs4290 mdm9250 sd765g_firmware qca6420_firmware qca6390_firmware apq8009_firmware sd690_5g qca6174_firmware sd730_firmware wcd9370 sd675_firmware sd625 qca6426 qca6584au_firmware wcn3990_firmware apq8076_firmware qca9377 sdw2500_firmware wcd9385_firmware sdxr2_5g_firmware wcd9326_firmware wcn3615_firmware sd662 apq8037 qca6320_firmware qca6584 wcn3680b_firmware sdx55_firmware wcn3615 qca6595au sm7250p_firmware wcn3610_firmware qca6436_firmware mdm9207 wcd9306 qca6584au sd778g qca6564au_firmware msm8208 qca6310 wcn7851 sd429 sa515m_firmware qcs6490 sdxr2_5g qca9367 sdm630 mdm9607_firmware sd821 mdm9655_firmware msm8976sg sa415m_firmware wcn3988_firmware sd205 sd429_firmware qca6421 sd778g_firmware sm6250 sd712_firmware apq8017_firmware wsa8810_firmware sd765_firmware wcd9326 wcd9335 sg4150p qca8081 qca6174a_firmware qcs4290_firmware wcd9385 qcs6490_firmware sdx70m_firmware qca6390 wcd9375 sd750g_firmware aqt1000 msm8956 msm8976 sc8180x\+sdx55_firmware sm6250_firmware ar8035 msm8952 apq8056 msm8917_firmware sda429w sd210 wcn3620_firmware sdx20_firmware wsa8815_firmware sd888_5g_firmware sd820 qcm6490 wcn6850_firmware wsa8835_firmware wcn3620 apq8017 qcx315 qca6564a mdm9630_firmware sg4150p_firmware qcm6125_firmware qcm4325 qcm2290_firmware wcn3990 sd_675 sd780g sd865_5g qcc5100 sdx24 sd888 msm8952_firmware msm8909w_firmware qcx315_firmware wsa8835 msm8996au sdm429w_firmware sd665_firmware sd888_5g sm6250p qca6574a mdm9206 wcn6855_firmware qca6174a sm7325p qca6310_firmware wcn6750 apq8052_firmware mdm9205 sa515m qca6574_firmware sd855 sm7325p_firmware sd665 sdx57m_firmware sd765 qca6574a_firmware sd768g_firmware msm8209 sd850_firmware sm7315 apq8009 sd460 qca6391 sdxr1_firmware aqt1000_firmware msm8920 sdx65_firmware qcm4290 csrb31024_firmware qcm6490_firmware sdx50m sdx20 sd480_firmware msm8920_firmware sd_455 qca6574au sd710 mdm9607 sd205_firmware wcd9341_firmware qcm6125 wsa8810 mdm9150 wcn6856 wcn3680b sd835_firmware sd768g wcn6740 qca6696 sd845_firmware msm8608_firmware sdw2500 msm8940 apq8096au_firmware qcn6024 sd845 apq8037_firmware sm7250p sd720g_firmware sdx12 sw5100_firmware qcs410_firmware mdm9330 sd850 qts110_firmware Snapdragon

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-11304

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 5.80%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 23:05

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-10592

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.19% / 8.72%

7 Day CHG~0.00%

Published-12 Dec, 2019 | 08:30

Updated-04 Aug, 2024 | 22:24

Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum mode count in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Product-sdm632_firmware msm8996au_firmware sdm845 sdm450_firmware sdm632 sdm439 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8909w_firmware msm8996au sm7150 msm8917 sdm670 sxr2130 qcs605_firmware mdm9206 sdm670_firmware sdm636 sda845_firmware apq8098 mdm9206_firmware qcs605 msm8937_firmware sdm429_firmware sda660 sxr1130_firmware sxr1130 msm8909w msm8909_firmware apq8053_firmware sda845 nicobar msm8920 msm8953 sdm450 sdm636_firmware apq8098_firmware sdx20 msm8998_firmware sdm660 msm8920_firmware sdm630 mdm9607_firmware sm8250_firmware qcs405 sdm710 qm215 mdm9607 apq8017_firmware sdm710_firmware msm8937 mdm9207c_firmware mdm9207c sm8150_firmware msm8909 sxr2130_firmware apq8096au sdm439_firmware qcs405_firmware sdm630_firmware sda660_firmware qm215_firmware msm8953_firmware msm8940 sm6150_firmware apq8053 apq8096au_firmware msm8917_firmware sm8250 msm8998 sm8150 sdx20_firmware apq8017 nicobar_firmware sdm660_firmware sdm845_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-10537

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 10.29%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 05:25

Updated-04 Aug, 2024 | 22:24

Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eventually will lead to buffer overwrite when event data is copied to context buffer in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, QCA6574AU, QCN7605, QCS405, QCS605, SDM660, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-22081

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 2.09%

7 Day CHG~0.00%

Published-16 Sep, 2022 | 05:25

Updated-03 Aug, 2024 | 03:00

Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-22074

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 2.09%

7 Day CHG~0.00%

Published-16 Sep, 2022 | 05:25

Updated-03 Aug, 2024 | 03:00

Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Product-qca9377_firmware mdm9640_firmware qcs610 qca8337 qca6431_firmware sdx65 wcn3950_firmware qcs2290 qca6595au_firmware sa6155 msm8917 csra6620_firmware qcs605_firmware sd_675_firmware csra6640_firmware qcs6125_firmware sd632 sa415m wcn3998 wcd9371_firmware wcn3950 sd_8cx_gen2_firmware mdm9628 mdm9206_firmware sd_8_gen1_5g_firmware wcn3660b sd450_firmware sd460_firmware qca4020 wcn7850 qca6574au_firmware wcd9375_firmware wcn3998_firmware qca8081_firmware sa6155_firmware msm8909w apq8009w_firmware qca6420 apq8053_firmware sm7450_firmware sd680_firmware qca9367_firmware wcn3999 sd_8cx_gen2 qrb5165_firmware qrb5165m_firmware qcs6125 sa8155_firmware sd662_firmware qcs405 qca6430 wcd9340 sd765g qualcomm215_firmware sw5100 sd680 qca4020_firmware qca6436 wcn6851 sa6155p qcs603_firmware wcn7851_firmware msm8937 mdm9250_firmware wcn3660_firmware wcd9341 pm8937_firmware qca6696_firmware qca6431 wcd9371 sd870_firmware sd750g wcn3910_firmware wsa8830_firmware sd855_firmware sd660 sd865_5g_firmware wcn3988 sd660_firmware wcn7850_firmware sa8195p_firmware sm8475 wcn6750_firmware sd450 wcn3610 mdm9640 wcn3991 qca8337_firmware wcd9380_firmware sdm429w sw5100p msm8996au_firmware wcd9330 qca6564au sdx55m_firmware wcn6856_firmware qca6574 sd632_firmware wcd9380 qualcomm215 qcs410 sd690_5g_firmware qca9379_firmware sdx24_firmware qca6430_firmware wcd9335_firmware wcn3980 sd439_firmware qcs605 wcd9340_firmware wsa8815 wcn6850 wcn3910 qca6320 qca6584_firmware msm8937_firmware mdm9650_firmware qca6426_firmware wcn3660b_firmware wcn3680 sd835 wcn3980_firmware sd730 wcd9330_firmware sdx55m qca6421_firmware sm8475_firmware wcn6740_firmware msm8953 sd678_firmware ar8031_firmware wcn3680_firmware qrb5165 wcn6851_firmware qcs603 sd_636_firmware qca6564a_firmware apq8009w qcm4290_firmware sd480 sd870 wcn6855 wsa8832 sw5100p_firmware qcs610_firmware sa6145p sdxr1 ar8031 apq8096au qcs405_firmware sdm630_firmware qca6391_firmware wcd9370_firmware sd780g_firmware sdx55 apq8053 sa8155p csra6640 sd675 sd439 wcn3660 sm8475p_firmware qca9379 ar8035_firmware qcm2290 wcn3991_firmware mdm9150_firmware wsa8830 sd678 qcs2290_firmware csrb31024 mdm9628_firmware mdm9650 sd_636 csra6620 qcs4290 mdm9250 sd765g_firmware qca6420_firmware qca6390_firmware apq8009_firmware sd690_5g sd730_firmware wcd9370 sd675_firmware qca6426 wcn3990_firmware qrb5165n_firmware qca9377 sdw2500_firmware wcd9385_firmware sdxr2_5g_firmware wcd9326_firmware wcn3615_firmware sd662 sa8155 qca6320_firmware qca6584 wcn3680b_firmware sdx55_firmware wcn3615 qca6595au wcn3999_firmware sm7250p_firmware wcn3610_firmware qca6436_firmware qrb5165n qca6564au_firmware sa6155p_firmware qca6310 pm8937 wcn7851 sd429 sdxr2_5g qca9367 sdm630 mdm9607_firmware sa415m_firmware wcn3988_firmware sd429_firmware sa6145p_firmware qca6421 sa8195p apq8017_firmware wsa8810_firmware sd765_firmware wcd9326 wcd9335 qca8081 qca6174a_firmware qcs4290_firmware wcd9385 qca6390 wcd9375 sd750g_firmware aqt1000 ar8035 msm8953_firmware msm8917_firmware wcn3620_firmware sdx20_firmware wsa8815_firmware sd888_5g_firmware wcn6850_firmware wsa8835_firmware wcn3620 sm7450 apq8017 qca6564a qcm6125_firmware qcm2290_firmware wcn3990 sd_675 sd780g sd865_5g sdx24 msm8909w_firmware wsa8835 msm8996au sdm429w_firmware sd665_firmware sd888_5g qca6574a mdm9206 wcn6855_firmware qca6174a qca6310_firmware wcn6750 qca6574_firmware sd855 sd665 sd765 qca6574a_firmware sd768g_firmware qrb5165m apq8009 sd460 qca6391 sdxr1_firmware aqt1000_firmware sdx65_firmware mdm9626 qcm4290 csrb31024_firmware wsa8832_firmware sdx20 sd480_firmware mdm9626_firmware qca6574au sa8155p_firmware mdm9607 wcd9341_firmware qcm6125 wsa8810 mdm9150 wcn6856 wcn3680b sd835_firmware sd768g wcn6740 qca6696 sdw2500 apq8096au_firmware sm7250p sw5100_firmware qcs410_firmware sm8475p Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-22089

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 2.09%

7 Day CHG~0.00%

Published-16 Sep, 2022 | 05:25

Updated-03 Aug, 2024 | 03:00

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2017-18070

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 6.08%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 01:42

In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead to a heap overwrite of the heap object end_rsp in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2017-18279

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 12.37%

7 Day CHG~0.00%

Published-06 May, 2019 | 22:58

Updated-05 Aug, 2024 | 21:13

Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon Wear in FSM9055, FSM9955, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 835, SDM630, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016.

Product-mdm9640_firmware qca9980_firmware msm8996au_firmware fsm9955_firmware qca9563_firmware mdm9650 qca9558 qca9558_firmware sd_615_firmware snapdragon_high_med_2016_firmware msm8909w_firmware msm8996au qca9880_firmware sd_650 sd_820 sd_450_firmware ipq4019_firmware mdm9206 sd_652 sd_425_firmware sd_800_firmware sd_625_firmware sd_450 sdm636 mdm9206_firmware qca9563 qca9886 sd_835_firmware mdm9650_firmware sd_835 ipq8064 sd_210_firmware sd_415_firmware sd_652_firmware msm8909w sd_616_firmware sd_205_firmware ipq8064_firmware sd_415 sd_212 sd_650_firmware sd_427_firmware fsm9055 sdm636_firmware sdx20 sd_616 sd_425 sdm660 sd_430_firmware mdm9607_firmware sd_435 sd_615 sdm630 qca9531 sd_625 sd_820_firmware sd_210 mdm9607 qca9980 qca9880 sd_800 fsm9055_firmware qca9886_firmware snapdragon_high_med_2016 sd_212_firmware sdm630_firmware fsm9955 sd_430 ipq4019 sd_427 sd_810 sd_435_firmware sdx20_firmware qca9531_firmware sd_205 sd_810_firmware sdm660_firmware mdm9640 Small Cell SoC, Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-43530

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-5.9||MEDIUM

EPSS-0.11% / 1.45%

7 Day CHG~0.00%

Published-06 May, 2024 | 14:32

Updated-11 Aug, 2025 | 15:06

Integer Overflow or Wraparound in HLOS

Memory corruption in HLOS while checking for the storage type.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-43545

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.10% / 1.12%

7 Day CHG~0.00%

Published-03 Jun, 2024 | 10:05

Updated-27 Jan, 2025 | 19:08

Integer Overflow or Wraparound in WLAN HOST

Memory corruption when more scan frequency list or channels are sent from the user space.

Product-qca6584au_firmware qca6554a qcc2076_firmware qca8337_firmware wcd9335_firmware qfw7124_firmware qca6696_firmware qcc710 qca8081_firmware qcc2073_firmware qca6595au_firmware qca6584au qcn6224_firmware qfw7114_firmware qca8081 snapdragon_660_mobile qca6554a_firmware wcn3990 qca6564au sd660 qcn6224 snapdragon_x75_5g_modem-rf qcn6274_firmware qfw7114 fastconnect_7800 wcn3990_firmware ar8035 fastconnect_7800_firmware qca6564au_firmware qcc2073 sd660_firmware wcd9341_firmware wcd9340 qca6595_firmware qca8337 wcn3980_firmware qcc710_firmware ar8035_firmware qcn6274 qfw7124 qca6574a qca6595 qca6574a_firmware qcc2076 wcd9341 wcn3980 qca6574au qca6574 wcd9340_firmware wcd9335 qca6574_firmware qca6696 qca6595au snapdragon_660_mobile_firmware qca6574au_firmware snapdragon_x75_5g_modem-rf_firmware Snapdragon qca6564au_firmware qca8337_firmware qca6584au_firmware qcn6274_firmware wcn3990_firmware qca6696_firmware qca6595_firmware wcd9335_firmware qfw7114_firmware qcc2076_firmware qca6554a_firmware snapdragon_x75_5g_modem-rf_system_firmware qcc2073_firmware qca6574_firmware wcd9340_firmware qcc710_firmware qcn6224_firmware snapdragon_660_mobile_platform_firmware qca6574a_firmware sd660_firmware wcd9341_firmware fastconnect_7800_firmware qca6574au_firmware qca6595au_firmware qca8081_firmware wcn3980_firmware qfw7124_firmware ar8035_firmware

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-43550

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.11% / 1.52%

7 Day CHG~0.00%

Published-04 Mar, 2024 | 10:48

Updated-11 Aug, 2025 | 15:06

Integer Overflow or Wraparound in Core Services

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2017-15854

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 6.00%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 02:11

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2017-15828

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 8.05%

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 20:04

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing the keystore in LK, an integer overflow vulnerability exists which may potentially lead to a buffer overflow.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2017-11085

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.14% / 3.52%

7 Day CHG~0.00%

Published-16 Nov, 2017 | 22:00

Updated-13 May, 2026 | 00:24

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler, file msm-audio-effects-q6-v2.c

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2013-2596

Matching Score-10

Assigner-MITRE Corporation

Vendor-n/a Motorola Mobility LLC. (Lenovo Group Limited)Qualcomm Technologies, Inc.Linux Kernel Organization, Inc

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-3.37% / 87.42%

7 Day CHG~0.00%

Published-13 Apr, 2013 | 01:00

Updated-21 Apr, 2026 | 18:14

Known KEV||Action Due Date - 2022-10-06||Apply updates per vendor instructions.

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

Product-razr_m msm8960 razr_hd atrix_hd android linux_kernel n/a Kernel

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2022-25656

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.12% / 2.09%

7 Day CHG~0.00%

Published-16 Sep, 2022 | 05:25

Updated-03 Aug, 2024 | 04:42

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Product-qca9377_firmware wcn3991_firmware wsa8830 qca8337 sdx65 wcn3950_firmware qca6595au_firmware qca6390_firmware wcd9370 qca6426 qca9377 wcn3998 wcd9385_firmware sdxr2_5g_firmware wcn3950 wcd9326_firmware sd_8_gen1_5g_firmware sd460_firmware sm7315_firmware wcn7850 qca6574au_firmware qca6595au qca8081_firmware sdx12_firmware wcd9375_firmware wcn3998_firmware qca6436_firmware sm7450_firmware sd778g sa6155p_firmware wcn7851 qcs6490 sdxr2_5g wcn3988_firmware sd778g_firmware sa8195p wsa8810_firmware sw5100 qca6436 wcd9326 wcd9335 sa6155p wcn6851 qca8081 wcn7851_firmware qca6174a_firmware wcd9385 wcd9341 qca6696_firmware qcs6490_firmware sd870_firmware qca6390 ar8035 wcd9375 wsa8830_firmware sd865_5g_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wcn7850_firmware wsa8815_firmware sa8195p_firmware sm7450 wsa8835_firmware sm8475 wcn6750_firmware wcn3991 qca8337_firmware wcd9380_firmware sw5100p sd780g sd865_5g sdx55m_firmware wcn6856_firmware sd888 wsa8835 qca6574 wcd9380 sd888_5g qca6574a wcn6855_firmware qca6174a sm7325p wcd9335_firmware wcn3980 wcn6750 qca6574_firmware wsa8815 sm7325p_firmware wcn6850 qca6426_firmware qca6574a_firmware sd695 wcn3980_firmware sm7315 sd460 qca6391 sdx55m sm8475_firmware wcn6740_firmware sdx65_firmware qcm6490_firmware wsa8832_firmware sd480_firmware wcn6851_firmware qca6574au sa8155p_firmware wcd9341_firmware sd480 sd870 wsa8810 wcn6855 wsa8832 sw5100p_firmware wcn6856 sd695_firmware wcn6740 qca6696 qca6391_firmware sd780g_firmware wcd9370_firmware sd888_firmware sa8155p sw5100_firmware sdx12 sm8475p_firmware ar8035_firmware sm8475p Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-33107

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.89% / 55.43%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:04

Updated-28 Oct, 2025 | 13:47

Known KEV||Action Due Date - 2023-12-26||Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-33022

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.16% / 5.45%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:04

Updated-11 Aug, 2025 | 15:06

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Product-qdx1010_firmware qcm8550_firmware qcs410_firmware sa6150p_firmware sd865_5g sw5100p sxr1120 vision_intelligence_300_platform qca6595 snapdragon_xr1_platform qcs610_firmware wcd9335 wcd9370 qca8081_firmware sm7250-ab snapdragon_x50_5g_modem-rf_system qca6696 wcd9340_firmware wcd9341_firmware wcd9395_firmware qcn6024 qca6390 qcc710_firmware qca6426 sc8180x-ab wcn6740_firmware sa4150p sm7325-ae_firmware wsa8832_firmware qca8337 qdu1110 qca6426_firmware wcd9395 qca6574au_firmware qcn7606_firmware wcn785x-5 qam8295p sm8150_firmware wcd9341 qca6574au wcd9390 wsa8810_firmware sd730_firmware wsa8845h_firmware csra6640 sc8180x-af_firmware sa9000p_firmware sd730 sdm670 qcs5430 sm8150-ac sm6375_firmware qcn6024_firmware sm7150-ac qcm5430 qcm5430_firmware video_collaboration_vc1_platform_firmware sa4155p sm8350 sa8770p qcm6125_firmware ssg2115p qcc710 sm6375 sa8540p sm7250-aa_firmware sxr1120_firmware qsm8250_firmware sc8180xp-ac qsm8350_firmware 315_5g_iot_modem_firmware sm8450_firmware video_collaboration_vc1_platform qru1032_firmware qfw7114 wcd9385_firmware qca6421 315_5g_iot_modem snapdragon_x55_5g_modem-rf_system qam8255p_firmware sa8155_firmware sm7150-ab qcs603_firmware wcd9360 snapdragon_ar2_gen_1_platform_firmware sc7180-ad sc8180xp-af snapdragon_8\+_gen_2_mobile_platform_firmware wsa8845 sa6155p qca6421_firmware qcm6125 sm7150-ac_firmware sc8180x-ad sm7125 wsa8810 qam8650p qdu1000_firmware sa9000p qsm8250 snapdragon_8\+_gen_2_mobile_platform sm8350-ac qca6595au sm7325_firmware sm7315_firmware qdu1010 wcd9326_firmware sa6155p_firmware wsa8840 qcs8550_firmware qca6390_firmware qdu1210_firmware qfw7124_firmware qca6436_firmware sc8180x-af wcd9371_firmware snapdragon_8_gen_2_mobile_platform wcn3910_firmware snapdragon_7c\+_gen_3_compute_firmware sm4125_firmware sm8250-ac_firmware qca6420 wcn3910 wcd9370_firmware snapdragon_x55_5g_modem-rf_system_firmware qdu1110_firmware qdu1000 qca6574a sm7325-ae sa8195p wcd9340 qcm2290 qdu1210 sm6150-ac sm6225 snapdragon_auto_5g_modem-rf_gen_2 sc8180xp-aa_firmware qcm6490 sa8540p_firmware sm8150-ac_firmware sm8550p_firmware wcn3998_firmware qcm8550 wcn3988 qcn9024 sa8775p qca6574 sm7325-af snapdragon_x75_5g_modem-rf_system sxr2230p_firmware sd675_firmware sdm710_firmware qca6430_firmware sc8180x-aa sa8775p_firmware qcs605 qcn9024_firmware wsa8845h sc8180xp-ac_firmware sa6150p sm7250-aa wcd9326 qcs410 qcm2290_firmware sa8155p_firmware sa8155p wsa8830 snapdragon_675_mobile_platform snapdragon_662_mobile_platform sm8550p sa6145p sc8180x\+sdx55_firmware sa8255p_firmware flight_rb5_5g_platform_firmware wcn785x-1_firmware ar8035 sa6155 qrb5165m_firmware qcm4325 qcn6224 sc8280xp-ab sc8180x\+sdx55 qca6698aq wcn3950_firmware ssg2125p_firmware sm6250 qrb5165n sc7180-ac sm7250-ac sc8180x-aa_firmware sd670 wcn685x-1 sm7325p_firmware sa8145p_firmware wcd9360_firmware qdx1011 sa8150p_firmware snapdragon_w5\+_gen_1_wearable_platform video_collaboration_vc3_platform_firmware wcn3990 sd670_firmware qcs6490 sc8280xp-bb_firmware wsa8830_firmware sm7150-aa qcn6224_firmware qca6431 wsa8845_firmware wsa8832 qcs603 sm6350 sxr2130_firmware snapdragon_675_mobile_platform_firmware ar8035_firmware qrb5165m sc8380xp snapdragon_w5\+_gen_1_wearable_platform_firmware sm8250-ab_firmware sa4150p_firmware sd888_firmware snapdragon_662_mobile_platform_firmware qcs6125_firmware sm6225_firmware sc8180xp-ad sm6250p_firmware sm7325-af_firmware sdm712_firmware wsa8815_firmware sm8250-ab sa8195p_firmware qca8337_firmware qcm4290 sm7325 sm6125_firmware sg8275p_firmware qcm6490_firmware sm8350-ac_firmware sm7250p_firmware sm4125 qru1032 wcn785x-5_firmware wcn3950 flight_rb5_5g_platform snapdragon_xr2_5g_platform sm4250-aa qcs6125 apq5053-aa_firmware snapdragon_x65_5g_modem-rf_system_firmware qca6797aq_firmware snapdragon_auto_5g_modem-rf_gen_2_firmware snapdragon_7c\+_gen_3_compute snapdragon_xr2\+_gen_1_platform_firmware sm4350_firmware sm7350-ab_firmware wcn3991 sa8295p_firmware sd_675_firmware apq5053-aa sdm710 sa4155p_firmware sm7250p sm6250_firmware sa8155 sc8180x-ad_firmware sm7150-aa_firmware qca6584au sd888 qcn6274_firmware qru1062_firmware sw5100_firmware wcn685x-5 wcn6740 sc8380xp_firmware qru1062 sm6225-ad_firmware qfw7114_firmware qcs605_firmware sc8280xp-ab_firmware qca6595_firmware sm8250-ac sm8250_firmware wcd9371 sc8180xp-aa sm7225 wcd9380 sa6145p_firmware qam8255p sa6155_firmware sxr2230p snapdragon_xr2_5g_platform_firmware sa8150p vision_intelligence_300_platform_firmware sm7350-ab snapdragon_auto_5g_modem-rf_firmware qrb5165_firmware sm8350_firmware sxr1230p sm6225-ad sm4350-ac sw5100 video_collaboration_vc3_platform aqt1000 sm8150 wcn3991_firmware qam8295p_firmware sd855 qca6431_firmware sc8180x-ab_firmware sm7225_firmware wcn3990_firmware sm7315 sm6125 qca6698aq_firmware qcs2290 wcd9385 qcn7606 qsm8350 qcs2290_firmware sc8280xp-bb sc8180xp-ab_firmware sa8255p qcs4290 sxr1230p_firmware wcd9390_firmware sc8180xp-ab wcn6750 qca6430 sg8275p wcn6750_firmware sm6250p sdx55_firmware qdx1011_firmware sc8180xp-ad_firmware snapdragon_auto_5g_modem-rf sm7250-ab_firmware ssg2125p qru1052 sxr2130 sm7150-ab_firmware csra6640_firmware sm4350 snapdragon_xr2\+_gen_1_platform sm7325p qam8650p_firmware wcn3998 qca6420_firmware aqt1000_firmware qcs6490_firmware sm8450 sm6150-ac_firmware snapdragon_x65_5g_modem-rf_system sd855_firmware wcd9335_firmware qrb5165n_firmware qca6436 wcn3980_firmware qca6584au_firmware wsa8835 wsa8840_firmware qca6391_firmware sc8180x-ac qcn6274 qfw7124 qdu1010_firmware qca6595au_firmware sc8180x-ac_firmware sm4250-aa_firmware sw5100p_firmware sm8250 snapdragon_ar2_gen_1_platform qca6696_firmware qcs4290_firmware wcd9380_firmware qca6574_firmware csra6620 sdm670_firmware qca8081 wsa8815 sm4375 sg4150p qam8775p qca6797aq sm4375_firmware qcm4325_firmware sm7125_firmware qca6574a_firmware sdx55 qcm4290_firmware sm6350_firmware sd675 wcd9375_firmware qca6391 qrb5165 wcn785x-1 qcs5430_firmware sg4150p_firmware qru1052_firmware sc8180xp-af_firmware csra6620_firmware sa8770p_firmware sa8295p snapdragon_8_gen_2_mobile_platform_firmware qcs8550 snapdragon_xr1_platform_firmware snapdragon_x50_5g_modem-rf_system_firmware qam8775p_firmware sd865_5g_firmware sc7180-ad_firmware wcd9375 wcn685x-5_firmware sdm712 wcn3988_firmware sa8145p sd_675 sm4350-ac_firmware wsa8835_firmware ssg2115p_firmware snapdragon_x75_5g_modem-rf_system_firmware sc7180-ac_firmware sm7250-ac_firmware wcn3980 qdx1010 wcn685x-1_firmware qcs610 Snapdragon

CWE ID-CWE-190

Integer Overflow or Wraparound

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CVE-2023-33038

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.12% / 1.97%

7 Day CHG~0.00%

Published-02 Jan, 2024 | 05:38

Updated-14 Nov, 2024 | 19:30

Integer Overflow or Wraparound in Radio Interface Layer

Memory corruption while receiving a message in Bus Socket Transport Server.

CWE ID-CWE-190

Integer Overflow or Wraparound

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-33032

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.12% / 2.37%

7 Day CHG~0.00%

Published-02 Jan, 2024 | 05:38

Updated-16 Jun, 2025 | 18:30

Integer Overflow or Wraparound in TZ Secure OS

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

CWE ID-CWE-190

Integer Overflow or Wraparound

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-28537

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.11% / 1.59%

7 Day CHG~0.00%

Published-08 Aug, 2023 | 09:15

Updated-02 Aug, 2024 | 13:43

Integer Overflow or Wraparound in Audio

Memory corruption while allocating memory in COmxApeDec module in Audio.

CWE ID-CWE-190

Integer Overflow or Wraparound

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-11924

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.20% / 9.70%

7 Day CHG~0.00%

Published-24 May, 2019 | 16:32

Updated-05 Aug, 2024 | 08:24

Improper buffer length validation in WLAN function can lead to a potential integer oveflow issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150