CVE-2020-11170

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Sna	APQ8009, APQ8009W, APQ8017, APQ8030, APQ8037, APQ8052, APQ8053, APQ8056, APQ8060A, APQ8062, APQ8064, APQ8064AU, APQ8076, APQ8084, APQ8096AU, AQT1000, AR6003, AR8031, AR8035, AR8151, AR9374, CSRA6620, CSRA6640, MDM8207, MDM8215, MDM8215M, MDM8615M, MDM8635M, MDM9205, MDM9206, MDM9207, MDM9215, MDM9225, MDM9225M, MDM9230, MDM9235M, MDM9310, MDM9330, MDM9607, MDM9615, MDM9615M, MDM9625, MDM9625M, MDM9628, MDM9630, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MPQ8064, MSM8108, MSM8208, MSM8209, MSM8226, MSM8227, MSM8230, MSM8608, MSM8610, MSM8626, MSM8627, MSM8630, MSM8909W, MSM8917, MSM8920, MSM8930, MSM8937, MSM8940, MSM8952, MSM8953, MSM8956, MSM8960, MSM8960SG, MSM8962, MSM8976, MSM8976SG, MSM8996AU, PM215, PM3003A, PM4125, PM4250, PM439, PM456, PM6125, PM6150, PM6150A, PM6150L, PM6250, PM6350, PM660, PM660A, PM660L, PM670, PM670A, PM670L, PM7150A, PM7150L, PM7250, PM7250B, PM7350C, PM8004, PM8005, PM8008, PM8009, PM8018, PM8019, PM8110, PM8150, PM8150A, PM8150B, PM8150C, PM8150L, PM8226, PM8 ...[truncated*]

References

https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletinVendor Advisory

Timeline

Published: Feb 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-111719.1Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Co CVE-2020-111729.8u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdra CVE-2020-111737.0u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, S CVE-2020-111747.8u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon CVE-2020-111757.8u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to improp CVE-2020-111769.8While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which CVE-2020-111778.8User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapd CVE-2020-111787.8Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping with its memory and its CVE-2020-111797.0Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition. in Snapdragon Aut CVE-2020-11188.6A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain CVE-2020-111807.8Out of bound access in computer vision control due to improper validation of command length before processing it in Snapdragon Auto, Snapdra CVE-2020-111817.8Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snap