CVE-2019-10481

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8996AU, QCA6574AU, QCA8081, QCN7605, SDX55, SM6150, SM7150, SM8150

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-104825.9Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channeCVE-2019-104835.5Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon ComCVE-2019-104845.5Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previoCVE-2019-104857.5Infinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, CVE-2019-104867.0Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in CVE-2019-104879.8Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Snapdragon Auto, SnapdrCVE-2019-104887.5Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, Snapdragon Compute, SCVE-2019-104897.5Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer ICVE-2019-10494.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker wCVE-2019-104905.5Use after free issue in Xtra daemon shutdown due to static object instance getting freed from a multiple places in Snapdragon Auto, SnapdragCVE-2019-104917.8ADSP can be compromised since it`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumCVE-2019-104927.8Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 21
CVE-2019-10481: High severity, CVSS 7.8 | Vulnix