Qualcomm Snapdragon High Med 2016 Firmware vulnerabilities

100 CVEs affecting Qualcomm Snapdragon High Med 2016 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-11076, published 2024-11-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2256, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-2255, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-2249, published 2019-11-06. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2018-11945, published 2019-02-25. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer…
CVE-2019-2252, published 2019-09-30. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2018-13924, published 2019-07-22. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Lack of check to prevent the buffer length taking negative values can lead to stack overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer…
CVE-2018-13886, published 2019-05-24. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Unchecked OTA field in GNSS XTRA3 lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…
CVE-2019-2271, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-2285, published 2019-11-06. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2018-13911, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Out of bounds memory read and access may lead to unexpected behavior in GNSS XTRA Parser in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,…

Latest

CVE-2017-11076, published 2024-11-26. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
CVE-2019-2337, published 2019-12-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device to shutdown in Snapdragon Auto, Snapdragon Compute,…
CVE-2019-2321, published 2019-12-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-2320, published 2019-12-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2019-2288, published 2019-12-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-10511, published 2019-12-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile,…
CVE-2019-10493, published 2019-12-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,…
CVE-2019-10485, published 2019-12-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Infinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon…
CVE-2019-2335, published 2019-11-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
CVE-2019-2318, published 2019-11-21. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…