CVE-2020-11201

HIGH

Qualcomm Snapdragon - Arbitrary DSP Memory Access via Improper Library Check

Title source: llm
STIX 2.1

Description

Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCM6125, QCS410, QCS603, QCS605, QCS610, QCS6125, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA845, SDM640, SDM830, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6150, SM6250, SM6250P, SM7125, SM7150, SM7150P, SM8150, SM8150P

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

Scores

CVSS v3 7.8
EPSS 0.0005
EPSS Percentile 16.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (28)
qualcomm/qcm6125_firmware
qualcomm/qcs410_firmware
qualcomm/qcs603_firmware
qualcomm/qcs605_firmware
qualcomm/qcs610_firmware
qualcomm/qcs6125_firmware
qualcomm/sa6145p_firmware
qualcomm/sa6155_firmware
qualcomm/sa6155p_firmware
qualcomm/sa8155_firmware
... and 18 more
Published Nov 12, 2020
Tracked Since Feb 18, 2026