ByteOS

Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Product

Versions

Affected

APQ8096AU, MSM8996AU, QAM8295P, QCA6310, QCA6320, QCA6335, QCA6390, QCA6391, QCA6421, QCA6426, QCA6431, QCA6436, QCA6564, QCA6564A, QCA6564AU, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCC5100, QCS410, QCS610, SA6145P, SA6150P, SA6155P, SA8145P, SA8150P, SA8155P, SA8195P, SA8295P, SD 8 Gen1 5G, SD429, SD710, SD778G, SD780G, SD835, SD845, SD865 5G, SD870, SD888, SD888 5G, SDA429W, SDM429W, SDX55M, SDXR1, SDXR2 5G, SM7315, SM7325P, SW5100, SW5100P, WCD9326, WCD9335, WCD9340, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WCN3610, WCN3620, WCN3660B, WCN3680B, WCN3950, WCN3980, WCN3988, WCN3990, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WCN7850, WCN7851, WSA8810, WSA8815, WSA8830, WSA8835

Problem Types

Type	CWE ID	Description
text	N/A	Untrusted Pointer Dereference in Video

Type: text

CWE ID: N/A

Description: Untrusted Pointer Dereference in Video

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin	N/A

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin	x_transferred

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-119	CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Type: CWE

CWE ID: CWE-119

Description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@qualcomm.com

Published At:19 Oct, 2022 | 11:15

Updated At:15 May, 2025 | 19:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*

>>apq8096au_firmware>>-

cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*

>>apq8096au>>-

cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*

>>msm8996au_firmware>>-

cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:*

>>msm8996au>>-

cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*

>>qam8295p_firmware>>-

cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*

>>qam8295p>>-

cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*

>>qca6310_firmware>>-

cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*

>>qca6310>>-

cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*

>>qca6320_firmware>>-

cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*

>>qca6320>>-

cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*

>>qca6335_firmware>>-

cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*

>>qca6335>>-

cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*

>>qca6390_firmware>>-

cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*

>>qca6390>>-

cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*

>>qca6391_firmware>>-

cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*

>>qca6391>>-

cpe:2.3:o:qualcomm:qca6421_firmware:-:*:*:*:*:*:*:*

>>qca6421_firmware>>-

cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*

>>qca6421>>-

cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*

>>qca6426_firmware>>-

cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*

>>qca6426>>-

cpe:2.3:o:qualcomm:qca6431_firmware:-:*:*:*:*:*:*:*

>>qca6431_firmware>>-

cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*

>>qca6431>>-

cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*

>>qca6436_firmware>>-

cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*

>>qca6436>>-

cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*

>>qca6564_firmware>>-

cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*

>>qca6564>>-

cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*

>>qca6564a_firmware>>-

cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*

>>qca6564a>>-

cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*

>>qca6564au_firmware>>-

cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*

>>qca6564au>>-

cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*

>>qca6574a_firmware>>-

cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*

>>qca6574a>>-

cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*

>>qca6574au_firmware>>-

cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*

>>qca6574au>>-

cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*

>>qca6595au_firmware>>-

cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*

>>qca6595au>>-

cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*

>>qca6696_firmware>>-

cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*

>>qca6696>>-

cpe:2.3:o:qualcomm:qcc5100_firmware:-:*:*:*:*:*:*:*

>>qcc5100_firmware>>-

cpe:2.3:h:qualcomm:qcc5100:-:*:*:*:*:*:*:*

>>qcc5100>>-

cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*

>>qcs410_firmware>>-

cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*

>>qcs410>>-

cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*

>>qcs610_firmware>>-

cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*

>>qcs610>>-

cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*

>>sa6145p_firmware>>-

cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*

>>sa6145p>>-

cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*

>>sa6150p_firmware>>-

cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*

>>sa6150p>>-

cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*

>>sa6155p_firmware>>-

cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*

>>sa6155p>>-

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov
CWE-119	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-119

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-119

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin	product-security@qualcomm.com	Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin

Source: product-security@qualcomm.com

Resource:

Vendor Advisory

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

478Records found

CVE-2019-10541

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 52.93%

7 Day CHG~0.00%

Published-06 Nov, 2019 | 17:11

Updated-04 Aug, 2024 | 22:24

Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20

Product-sd_850 sd_632 sd_820a sd_675 msm8996au_firmware sd_439 sd_670_firmware sd_429 sdm439 sd_636 msm8909w_firmware msm8996au sd_820 sd_450_firmware sd_845_firmware sd_820a_firmware qcs605_firmware sd_675_firmware mdm9206 sd_425_firmware sd_665 sd_625_firmware sd_450 sd_845 mdm9206_firmware qcs605 sd_632_firmware sd_835_firmware sd_835 qca6574au_firmware sda660 sd_210_firmware sd_600 msm8909w sd_665_firmware sd_205_firmware sd_212 sd_712 sd_855 sd_730_firmware qualcomm_215 sdx20 sd_425 sdm660 sdm630 mdm9607_firmware sd_710_firmware qcs405 sd_625 qca6574au sd_210 mdm9607 sd_636_firmware sd_820_firmware sd_439_firmware qualcomm_215_firmware sd_429_firmware sd_730 sd_212_firmware sd_850_firmware sdm439_firmware qcs405_firmware sd_712_firmware sdm630_firmware sda660_firmware sd_670 sd_710 sdx20_firmware sd_600_firmware sd_205 sdm660_firmware sd_855_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-908

Use of Uninitialized Resource

CVE-2019-10544

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 11.98%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 05:25

Updated-04 Aug, 2024 | 22:24

Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handlers in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Product-mdm9640_firmware sdm632_firmware msm8996au_firmware sdm845 sdm450_firmware sdm632 sdx24 sdm439 mdm9650 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8909w_firmware msm8996au sm7150 apq8009_firmware msm8917 sdm670 sxr2130 qcs605_firmware mdm9206 sdm670_firmware sdx24_firmware sdm636 sda845_firmware apq8098 qcn7605 mdm9206_firmware msm8939 qcs605 msm8937_firmware mdm9650_firmware sdm429_firmware msm8905_firmware sda660 sdx55_firmware sxr1130_firmware sxr1130 msm8909w apq8009 msm8909_firmware apq8053_firmware sda845 msm8920 msm8953 sdm450 sdm636_firmware sdm845_firmware apq8098_firmware sdx20 msm8998_firmware sdm660 msm8920_firmware sdm630 mdm9607_firmware sm8250_firmware qcs405 sdm710 qm215 mdm9607 apq8017_firmware sdm710_firmware msm8939_firmware qcn7605_firmware msm8937 mdm9207c_firmware msm8905 mdm9207c sm8150_firmware msm8909 sxr2130_firmware apq8096au sdm439_firmware qcs405_firmware sdm630_firmware sda660_firmware qm215_firmware sdx55 msm8953_firmware msm8940 sm6150_firmware apq8053 apq8096au_firmware msm8917_firmware sm8250 msm8998 sm8150 sdx20_firmware apq8017 sdm660_firmware mdm9640 Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-10624

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.76%

7 Day CHG~0.00%

Published-16 Apr, 2020 | 10:46

Updated-04 Aug, 2024 | 22:31

While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710, SDX55, SM7150, SM8150, SM8250, SXR2130

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-681

Incorrect Conversion between Numeric Types

CVE-2019-10626

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.04% / 12.18%

7 Day CHG~0.00%

Published-22 Jun, 2020 | 07:10

Updated-04 Aug, 2024 | 22:32

Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Rennell, Saipan, SC8180X, SDA660, SDA845, SDM429W, SDM439, SDM670, SDM710, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130

Product-mdm9640_firmware sdm429w msm8996au_firmware sdx24 sdm439 mdm9650 msm8909w_firmware msm8996au sdm429w_firmware apq8009_firmware sdm670 sxr2130 qcs605_firmware ipq4019_firmware sc8180x mdm9206 sdm670_firmware sdx24_firmware ipq8074 sda845_firmware apq8098 ipq6018_firmware mdm9206_firmware qcs605 mdm9650_firmware ipq8064 sda660 sdx55_firmware sxr1130_firmware sxr1130 msm8909w apq8009 apq8053_firmware ipq8064_firmware sda845 apq8098_firmware sdx20 mdm9607_firmware sm8250_firmware sc8180x_firmware qcs405 ipq8074_firmware sdm710 mdm9607 apq8017_firmware sdm710_firmware mdm9207c_firmware ipq6018 mdm9207c sm8150_firmware sxr2130_firmware apq8096au sdm439_firmware qcs405_firmware rennell sda660_firmware rennell_firmware ipq4019 sdx55 apq8053 apq8096au_firmware saipan_firmware sm8250 sm8150 sdx20_firmware apq8017 saipan mdm9640 Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-20

Improper Input Validation

CVE-2023-3024

Matching Score-6

Assigner-Silicon Labs

Matching Score-6

Assigner-Silicon Labs

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 24.35%

7 Day CHG~0.00%

Published-29 Sep, 2023 | 16:32

Updated-25 Sep, 2024 | 16:15

Bluetooth LE segmented 'prepare write response' packet may lead to out-of-bounds memory access

Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.

Vendor-silabs silabs.com Qualcomm Technologies, Inc.

Product-wsa8830 wcd9385 wsa8835 wcd9380 wcd9375 gecko_software_development_kit csrb31024 wcd9370 aqt1000 GSDK

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28549

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 5.80%

7 Day CHG~0.00%

Published-05 Sep, 2023 | 06:24

Updated-27 Feb, 2025 | 21:02

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28545

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8.2||HIGH

EPSS-0.04% / 11.08%

7 Day CHG~0.00%

Published-07 Nov, 2023 | 05:26

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-28586

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-6||MEDIUM

EPSS-0.04% / 10.65%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-28551

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.86%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-28550

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.86%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-28585

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8.2||HIGH

EPSS-0.04% / 11.08%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CVE-2023-28581

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.13% / 33.62%

7 Day CHG~0.00%

Published-05 Sep, 2023 | 06:24

Updated-27 Feb, 2025 | 21:01

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-28587

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 21.35%

7 Day CHG~0.00%

Published-05 Dec, 2023 | 03:03

Updated-11 Aug, 2025 | 15:06

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-5843

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 03:12

In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, there is no upper bound check on the value event->num_chains_valid received from firmware which can lead to a buffer overwrite of the fixed size chain_rssi_result structure.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5851

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 17:48

Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-129

Improper Validation of Array Index

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5917

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.93%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 05:47

Possible buffer overflow in OEM crypto function due to improper input validation in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5834

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 22.70%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 17:22

In __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5880

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 8.39%

7 Day CHG~0.00%

Published-18 Jan, 2019 | 22:00

Updated-05 Aug, 2024 | 05:47

Improper data length check while processing an event report indication can lead to a buffer overflow in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5889

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 2.72%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 16:58

While processing a compressed kernel image, a buffer overflow can occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5842

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 03:02

An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5862

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 5.72%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-17 Sep, 2024 | 01:21

In __wlan_hdd_cfg80211_vendor_scan() in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05, when SCAN_SSIDS and QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES are parsed, a buffer overwrite can potentially occur.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5835

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 20.75%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 16:39

If the seq_len is greater then CSR_MAX_RSC_LEN, a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5876

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8.8||HIGH

EPSS-0.46% / 63.02%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-17 Sep, 2024 | 02:16

While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5848

Matching Score-6

Assigner-Qualcomm, Inc.

Product-enterprise_linux_server debian_linux android enterprise_linux_workstation virtualization_host enterprise_linux_desktop Android for MSM, Firefox OS for MSM, QRD Android

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.13% / 33.33%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 00:31

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Vendor-Qualcomm Technologies, Inc.Google LLC Debian GNU/Linux Red Hat, Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5863

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.37%

7 Day CHG~0.00%

Published-15 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 20:32

If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5867

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.93%

7 Day CHG~0.00%

Published-18 Jan, 2019 | 22:00

Updated-05 Aug, 2024 | 05:47

Lack of checking input size can lead to buffer overflow In WideVine in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130

Product-sd_850 sd_632 mdm9635m_firmware sd_820a msm8996au_firmware sd_439 sd_670_firmware sd_429 sdx24 sdm439 mdm9650 sd_636 snapdragon_high_med_2016_firmware msm8996au sd_820 sd_650 sd_450_firmware sd_845_firmware sd_410 sd_820a_firmware mdm9206 sd_652 sd_425_firmware sdx24_firmware sd_625_firmware sd_450 mdm9635m sd_845 mdm9206_firmware sd_632_firmware sd_835_firmware mdm9650_firmware sd_835 sda660 sxr1130_firmware sd_210_firmware sd_652_firmware sxr1130 sd_205_firmware sd_650_firmware sd_212 sd_427_firmware sd_712 sd_412 sd_425 sdm660 sd_430_firmware mdm9607_firmware sd_435 mdm9655_firmware sd_710_firmware sdm630 sd_625 sd_210 mdm9607 sd_636_firmware sd_820_firmware sd_439_firmware sd_429_firmware snapdragon_high_med_2016 sd_212_firmware sd_850_firmware mdm9655 sdm439_firmware sd_412_firmware sd_712_firmware sdm630_firmware sda660_firmware sd_427 sd_430 sd_670 sd_435_firmware sd_710 sd_410_firmware sd_205 sdm660_firmware Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5866

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 7.69%

7 Day CHG~0.00%

Published-26 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 05:47

While processing logs, data is copied into a buffer pointed to by an untrusted pointer in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5875

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8.8||HIGH

EPSS-0.46% / 63.02%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-17 Sep, 2024 | 02:36

While parsing an mp4 file, an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5885

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.87%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-17 Sep, 2024 | 02:05

While loading dynamic fonts, a buffer overflow may occur if the number of segments in the font file is out of range in Snapdragon Mobile and Snapdragon Wear.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5872

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8||HIGH

EPSS-0.08% / 23.53%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 19:30

While parsing over-the-air information elements in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05, the use of an out-of-range pointer offset can occur.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5918

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.76%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 05:47

Possible buffer overflow in DRM Trusted application due to lack of check function return values in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5822

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.3||HIGH

EPSS-0.10% / 28.63%

7 Day CHG~0.00%

Published-03 Apr, 2018 | 17:00

Updated-16 Sep, 2024 | 22:09

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, compromised WLAN FW can potentially cause a buffer overwrite.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5868

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.93%

7 Day CHG~0.00%

Published-18 Jan, 2019 | 22:00

Updated-05 Aug, 2024 | 05:47

Lack of checking input size can lead to buffer overflow In WideVine in snapdragon automobile and snapdragon mobile in versions MSM8996AU, SD 425, SD 430, SD 450, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX24, SXR1130

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5827

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.37%

7 Day CHG~0.00%

Published-17 May, 2018 | 22:00

Updated-17 Sep, 2024 | 02:10

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5912

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 8.39%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 05:47

Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile, Snapdragon Mobile in MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-14006

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.36% / 57.13%

7 Day CHG~0.00%

Published-21 Jan, 2020 | 06:30

Updated-05 Aug, 2024 | 00:05

Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130

Product-sdm429w msm8996au_firmware sdm632_firmware sdm845 sdm450_firmware sdm632 sdm439 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8909w_firmware msm8996au sdm429w_firmware sm7150 apq8009_firmware msm8917 sdm670 sxr2130 qcs605_firmware mdm9206 sdm670_firmware sdm636 sda845_firmware apq8098 mdm9206_firmware msm8939 qcs605 msm8937_firmware sdm429_firmware msm8905_firmware sda660 apq8064_firmware msm8909w apq8009 msm8909_firmware apq8053_firmware sda845 nicobar sa6155p_firmware msm8920 msm8953 sdm450 sdm636_firmware apq8064 apq8098_firmware sdx20 sdm660 msm8920_firmware sdm630 mdm9607_firmware sm8250_firmware sdm710 qm215 mdm9607 apq8017_firmware sdm710_firmware msm8939_firmware sa6155p msm8937 mdm9207c_firmware msm8996_firmware msm8905 mdm9207c sm8150_firmware msm8909 sxr2130_firmware apq8096au sdm439_firmware rennell sdm630_firmware sda660_firmware rennell_firmware qm215_firmware msm8953_firmware msm8940 sm6150_firmware apq8053 apq8096au_firmware msm8917_firmware sm8250 sm8150 sdx20_firmware apq8017 msm8996 nicobar_firmware sdm660_firmware sdm845_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5870

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.01%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 05:47

While loading a service image, an untrusted pointer dereference can occur in Snapdragon Mobile in versions SD 835, SDA660, SDX24.

Product-sd_835_firmware sdx24_firmware sd_835 sda660 sda660_firmware sdx24 Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5911

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 12.81%

7 Day CHG~0.00%

Published-14 Jun, 2019 | 17:02

Updated-05 Aug, 2024 | 05:47

Buffer overflow in WLAN function due to improper check of buffer size before copying in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 855, SDM630, SDM660, SDX20, SDX24

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5878

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.51%

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 22:26

While sending the response to a RIL_REQUEST_GET_SMSC_ADDRESS message, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5877

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.01%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 15:00

Updated-05 Aug, 2024 | 05:47

In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incorrect buffer size in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 600, SD 820, SD 820A, SD 835, SDA660, SDX20.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5823

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 2.72%

7 Day CHG~0.00%

Published-03 Apr, 2018 | 17:00

Updated-16 Sep, 2024 | 16:58

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, improper buffer length validation in extscan hotlist event can lead to potential buffer overflow.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3573

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-19 Sep, 2018 | 14:00

Updated-05 Aug, 2024 | 04:50

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images with a specially crafted boot image, an out of bounds access can occur.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3583

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 9.80%

7 Day CHG~0.00%

Published-14 Jun, 2019 | 17:02

Updated-05 Aug, 2024 | 04:50

A buffer overflow can occur while processing an extscan hotlist event in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA9379, QCS605, SD 625, SD 636, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3568

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-17 May, 2018 | 22:00

Updated-17 Sep, 2024 | 01:36

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3581

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 16:49

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overwrite can occur if the vdev_id received from firmware is larger than max_bssid.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3562

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.06% / 19.24%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 21:56

Buffer over -read can occur while processing a FILS authentication frame in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3572

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.03%

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 20:12

While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3566

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.08% / 24.96%

7 Day CHG~0.00%

Published-03 Apr, 2018 | 17:00

Updated-16 Sep, 2024 | 19:25

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a buffer overwrite may occur in ProcSetReqInternal() due to missing length check.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3567

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 3.37%

7 Day CHG~0.00%

Published-17 May, 2018 | 22:00

Updated-17 Sep, 2024 | 04:09

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3578

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.03%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 20:52

Type mismatch for ie_len can cause the WLAN driver to allocate less memory on the heap due to implicit casting leading to a heap buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.