Actively exploited in the wild
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Qualcomm - Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables · Listed in the CISA KEV since 2021-12-01. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-11261
HighCVSS 7.8KEVSummary
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables.
Risk Assessment
May lead to memory corruption and potential code execution or device instability across a wide range of Snapdragon-based devices.
Recommendation
Apply security updates provided by the device vendor or Qualcomm for the relevant Snapdragon platforms.
Other vulnerabilities in Qualcomm Snapdragon
See all- CVE-2022-22071HighActively exploited
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress. This affects Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music.
- CVE-2021-1906MediumActively exploited
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. The vulnerability affects multiple Qualcomm Snapdragon platforms, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.
Original NVD description (English source)
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Vulnerability data from NVD (NIST) · CISA KEV · EPSS