CVE-2019-10620

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24, SM8150

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-106217.8Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, CVE-2019-106229.1Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdrag CVE-2019-106237.1Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in CVE-2019-106247.8While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 CVE-2019-106257.1Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Sn CVE-2019-106265.5Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Aut CVE-2019-106279.8Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters CVE-2019-106287.8u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, CVE-2019-106297.8u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdra CVE-2019-10637.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor CVE-2019-106308.8A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the dev CVE-2019-106318.8Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute a