CVE-2019-14049

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MSM8953, QCN7605, QCS605, SC8180X, SDA845, SDM429, SDM439, SDM450, SDM632, SDX20, SDX24, SDX55, SM8150, SXR1130

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-14057.8An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation CVE-2019-140507.8Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. in Snapdragon Auto, Sn CVE-2019-140517.8Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow CVE-2019-140529.8u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing' in Snapdragon Auto,CVE-2019-140537.1When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to CVE-2019-140547.8Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in CVE-2019-140557.8Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Sna CVE-2019-140567.8u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon Com CVE-2019-140579.1Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdra CVE-2019-14067.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-140607.8Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due to CVE-2019-140617.5Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Auto, Snapdr