CVE-2019-10538: Qualcomm MSM8909W Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can compromise HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM660, SDX20, SDX24

Affected products

  • Qualcomm MSM8909W Firmware: affected versions not specified
  • Qualcomm MSM8996AU Firmware: affected versions not specified
  • Qualcomm QCS405 Firmware: affected versions not specified
  • Qualcomm QCS605 Firmware: affected versions not specified
  • Qualcomm Qualcomm 215 Firmware: affected versions not specified
  • Qualcomm Sd 425 Firmware: affected versions not specified
  • Qualcomm Sd 429 Firmware: affected versions not specified
  • Qualcomm Sd 439 Firmware: affected versions not specified
  • Qualcomm Sd 450 Firmware: affected versions not specified
  • Qualcomm Sd 625 Firmware: affected versions not specified
  • Qualcomm Sd 632 Firmware: affected versions not specified
  • Qualcomm Sd 636 Firmware: affected versions not specified
  • Qualcomm Sd 665 Firmware: affected versions not specified
  • Qualcomm Sd 670 Firmware: affected versions not specified
  • Qualcomm Sd 675 Firmware: affected versions not specified
  • Qualcomm Sd 710 Firmware: affected versions not specified
  • Qualcomm Sd 712 Firmware: affected versions not specified
  • Qualcomm Sd 730 Firmware: affected versions not specified
  • Qualcomm Sd 820a Firmware: affected versions not specified
  • Qualcomm Sd 845 Firmware: affected versions not specified
  • Qualcomm Sd 850 Firmware: affected versions not specified
  • Qualcomm Sd 855 Firmware: affected versions not specified
  • Qualcomm SDA660 Firmware: affected versions not specified
  • Qualcomm SDM439 Firmware: affected versions not specified
  • Qualcomm SDM660 Firmware: affected versions not specified
  • and 2 more

Published 2019-09-30. Last modified 2026-06-17.