CVE-2018-13899

HIGH

Qualcomm Snapdragon Firmware - Use-After-Free in Message Processing

Title source: llm

Description

Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150

References (1)

Core 1

Core References

Patch, Third Party Advisory x_refsource_confirm

https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin

Scores

CVSS v3 7.8

EPSS 0.0003

EPSS Percentile 10.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (30)

qualcomm/mdm9150_firmware

qualcomm/mdm9206_firmware

qualcomm/mdm9607_firmware

qualcomm/mdm9650_firmware

qualcomm/msm8909w_firmware

qualcomm/qcs605_firmware

qualcomm/qm215_firmware

qualcomm/sd_425_firmware

qualcomm/sd_429_firmware

qualcomm/sd_439_firmware

... and 20 more

Published May 24, 2019

Tracked Since Feb 18, 2026