CVE-2018-11940
CRITICALSnapdragon Auto/Mobile/Compute/IOT - Memory Corruption
Title source: llmDescription
Lack of check in length before using memcpy in WLAN function can lead to OOB access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130
References (1)
Core 1
Core References
Patch, Third Party Advisory x_refsource_confirm
https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
Scores
CVSS v3
9.8
EPSS
0.0027
EPSS Percentile
50.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (24)
qualcomm/mdm9150_firmware
qualcomm/mdm9206_firmware
qualcomm/mdm9607_firmware
qualcomm/mdm9640_firmware
qualcomm/mdm9650_firmware
qualcomm/msm8996au_firmware
qualcomm/qcs605_firmware
qualcomm/sd_625_firmware
qualcomm/sd_636_firmware
qualcomm/sd_670_firmware
... and 14 more
Published
May 24, 2019
Tracked Since
Feb 18, 2026