CVE-2015-9199: Qualcomm IPQ4019 Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, SD 810, SD 820, and SD 820A, A non-secure region check is done while registering QSEE buffer address which is passed by HLOS but not while logging in the QSEE buffer, so corruption of dynamically protected secure region can occur if the non-secure buffer is changed between the time it's checked and when it's used.

Affected products

• Qualcomm IPQ4019 Firmware: affected versions not specified
• Qualcomm MDM9625 Firmware: affected versions not specified
• Qualcomm MDM9635M Firmware: affected versions not specified
• Qualcomm MDM9640 Firmware: affected versions not specified
• Qualcomm MDM9650 Firmware: affected versions not specified
• Qualcomm MDM9655 Firmware: affected versions not specified
• Qualcomm Sd 205 Firmware: affected versions not specified
• Qualcomm Sd 210 Firmware: affected versions not specified
• Qualcomm Sd 212 Firmware: affected versions not specified
• Qualcomm Sd 400 Firmware: affected versions not specified
• Qualcomm Sd 410 Firmware: affected versions not specified
• Qualcomm Sd 412 Firmware: affected versions not specified
• Qualcomm Sd 415 Firmware: affected versions not specified
• Qualcomm Sd 615 Firmware: affected versions not specified
• Qualcomm Sd 616 Firmware: affected versions not specified
• Qualcomm Sd 800 Firmware: affected versions not specified
• Qualcomm Sd 808 Firmware: affected versions not specified
• Qualcomm Sd 810 Firmware: affected versions not specified
• Qualcomm Sd 820 Firmware: affected versions not specified
• Qualcomm Sd 820a Firmware: affected versions not specified

Published 2018-04-18. Last modified 2026-06-17.