Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, Snapdragon…

Published 6 y ago 2020-03-05 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.1

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.9%

percentile 59%

Public exploits

none known

Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

Exploit prediction (EPSS)

0.88% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	9.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`
NVD	2.0	9.4	`AV:N/AC:L/Au:N/C:C/I:N/A:C`

Affected products

Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Classification

Weakness

CWE-125 Out-of-bounds Read

References

qualcomm.com /company/product-security/bulletins/march-2020-bulletin · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2019-10550
NVD: CVE-2019-10550

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.