CVE-2018-11925

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking	IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24

References

https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletinPatch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: May 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-119277.8Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from f CVE-2018-119287.8Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2018-119297.8Lack of input validation in WLAN function can lead to potential heap overflow in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indust CVE-2018-11935.3Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can CVE-2018-119309.8Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer t CVE-2018-119317.8Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr CVE-2018-119329.1Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, CVE-2018-119347.8Possible out of bounds write due to improper input validation while processing DO_ACS vendor command in Snapdragon Auto, Snapdragon Consumer CVE-2018-119355.3Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdrago CVE-2018-119369.8Index of array is processed in a wrong way inside a while loop and result in invalid index (-1 or something else) leads to out of bound memo CVE-2018-119379.8Lack of input validation before copying can lead to a buffer over read in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon C CVE-2018-119387.8Improper input validation for argument received from HLOS can lead to buffer overflows and unexpected behavior in Snapdragon Auto, Snapdrago