CVE-2019-10591

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8939, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS405, QCS605, QM215, Rennell, SA6155P, Saipan, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-105927.8Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum mode CVE-2019-105939.8Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Auto, Snapdra CVE-2019-105949.8Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Auto, Snapdr CVE-2019-105957.8Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware in Snapdr CVE-2019-105967.8u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdr CVE-2019-105977.8kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdrago CVE-2019-105987.8Out of bound access can occur while processing peer info in IBSS connection mode due to lack of upper bounds check to ensure that for loop f CVE-2019-10608.8A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code CVE-2019-106007.8Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid stack memory in Snapdr CVE-2019-106017.8Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from firmware in Snapdragon CVE-2019-106027.8Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2019-106037.8Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 message in Snapd