CVE-2019-14055

HIGH

Snapdragon Auto-MSM8996AU - Use After Free

Title source: llm

Description

Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8939, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS605, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130

References (1)

[Patch, Vendor Advisory] https://www.qualcomm.com/company/product-security/bulletins/february-2020-bulletin

Scores

CVSS v3 7.8

EPSS 0.0004

EPSS Percentile 10.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-415 CWE-416

Status published

Affected Products (38)

qualcomm/apq8009_firmware

qualcomm/apq8017_firmware

qualcomm/apq8053_firmware

qualcomm/apq8096au_firmware

qualcomm/apq8098_firmware

qualcomm/mdm9206_firmware

qualcomm/mdm9207c_firmware

qualcomm/mdm9607_firmware

qualcomm/mdm9640_firmware

qualcomm/mdm9650_firmware

qualcomm/msm8905_firmware

qualcomm/msm8909w_firmware

qualcomm/msm8939_firmware

qualcomm/msm8953_firmware

qualcomm/msm8996au_firmware

... and 23 more

Timeline

Published Feb 07, 2020

Tracked Since Feb 18, 2026