CVE-2019-14048

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Possible out of bound memory access while playing a crafted clip in media player in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in SM8150

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	SM8150

References

https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletinVendor Advisory

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-140497.8Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapd CVE-2019-14057.8An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation CVE-2019-140507.8Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. in Snapdragon Auto, Sn CVE-2019-140517.8Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow CVE-2019-140529.8u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing' in Snapdragon Auto,CVE-2019-140537.1When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to CVE-2019-140547.8Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in CVE-2019-140557.8Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Sna CVE-2019-140567.8u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon Com CVE-2019-140579.1Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdra CVE-2019-14067.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-140607.8Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due to