7.5high
CVE-2021-1981
Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdr…
Published 4 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Exploit prediction (EPSS)
0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
Affected products
- Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Classification
- Weakness
- CWE-125 Out-of-bounds Read
References
- qualcomm.com /company/product-security/bulletins/november-2021-bulletin · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2021-1981
- NVD: CVE-2021-1981
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.