CVE-2020-11261highunder attackCWE-20

CVE-2020-11261: high-severity vulnerability in Qualcomm, Inc. Snapdragon Auto, Snapdragon…

Published · Updated

Follow this CVE+ Monitor Snapdragon Mobile+ Monitor Snapdragon Industrial IOT

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 1.5%
from disclosure to weapon
Published on NVDJun 9
CISA KEV+175d
Action required by CISAfederal deadline: 2022-06-01

Apply updates per vendor instructions.

In short

A memory corruption flaw occurs when an application requests an extremely large amount of memory without proper validation, potentially causing system crashes or unexpected behavior on Snapdragon devices. This weakness can be exploited by local attackers to crash or compromise the system.

Technical detail

Improper input validation (CWE-20) in memory allocation routines fails to detect oversized allocation requests across multiple Snapdragon platforms. The vulnerability allows local attackers to trigger memory corruption by requesting allocation of excessive size, leading to denial of service or potential code execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Related CVEs — Qualcomm, Inc. Snapdragon Auto, Snapdragon…

In the same product, most dangerous first.

CVE-2021-1905HIGHCVE-2021-1905EPSS 1.5%KEVCVE-2021-1906MEDIUMCVE-2021-1906EPSS 0.5%KEVCVE-2019-2255—CVE-2019-2255EPSS 1.5%CVE-2019-2256—CVE-2019-2256EPSS 1.5%CVE-2020-11167—CVE-2020-11167EPSS 1.2%CVE-2019-2252—CVE-2019-2252EPSS 1.2%