CVE-2016-10386

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In all Qualcomm products with Android releases from CAF using the Linux kernel, an array index out of bounds vulnerability exists in LPP.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-103879.8In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a handover scenariCVE-2016-103889.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a configuration vulnerability exists when loading a 3rd-partCVE-2016-103897.8In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto theCVE-2016-10399.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC ContinCVE-2016-103909.8In all Qualcomm products with Android releases from CAF using the Linux kernel, when downloading a file, an excessive amount of memory may bCVE-2016-103919.8In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for valCVE-2016-103929.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a driver can potentially leak kernel memory.CVE-2016-103939.8In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with CVE-2016-103947.8Initial xbl_sec revision does not have all the debug policy features and critical checks.CVE-2016-103957.8In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary errorCVE-2016-103967.5The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragmCVE-2016-103977.5In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to byp
CVE-2016-10386: Critical severity, CVSS 9.8 | Vulnix